{"apiVersion":"1.0","identifier":"CVE-2026-99063","description":"In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don-t let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl). get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace: BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31) A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation. Clamp data_start to the buffer size. Note that this is not a security bug because the out-of-bounds read can only be triggered by root.","publishedAt":"2026-10-23T13:17:30","lastModifiedAt":"2026-10-30T13:21:43","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99063","cvssScore":null,"cvssVector":null,"epssProbability":0.00177,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99063","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99063","en":"https://www.redsauce.net/en/cves/CVE-2026-99063","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99063","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99063","de":"https://www.redsauce.net/de/cves/CVE-2026-99063","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99063","el":"https://www.redsauce.net/el/cves/CVE-2026-99063"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99063"}}