dm ioctl: don't let data_start run past the buffer
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl). get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace: BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31) A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation. Clamp data_start to the buffer size. Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
CVE-2026-99063
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-99063
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "98195e822343a656b92e235847ab3e72b1a3f920",
"versionType": "git"
},
{
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "e5c3f3d8935ecc64c962fb66e6a86dbf79218f61",
"versionType": "git"
},
{
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "5680b6fb3054677d4ee65d3baba24b649f1b430e",
"versionType": "git"
},
{
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "725b49c689bbb29ef740b0d6b5ea9390baa9a695",
"versionType": "git"
},
{
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "9b3fcf519d370df94a56f3b272d9eddffffa5be8",
"versionType": "git"
}
],
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.25",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-99063
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52888 · Revision 1
- Added to Heist Feed
- Publisher date