CVE-2026-46294

Περιγραφή

In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the -outptr- variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn-t check overflow, so outptr could point past the buffer end 4. The -for- loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If -outptr- points past -outbuf + len-, the arithmetics wraps around and the variable -remaining- contains unusually high number 6. With -remaining- being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, -outptr = align_ptr(outptr)- can-t overshoot the input buffer and the bug can-t happen accidentally