The dm-verity FEC (Reed‑Solomon) subsystem in the Linux kernel contains an assumption that parity bytes belonging to the first codeword are never split across parity blocks. For certain block sizes and root counts, such as block_size 4096 with fec_roots 17,19,21, or 23, and when the number of available buffers is limited, the parity data of a message block straddles a block boundary. Under these circumstances the decoder attempts to read more parity bytes than exist in the current block, causing an out‑of‑bounds read of the parity buffer within kernel memory. The fix re‑implements how parity blocks are accessed to eliminate the boundary condition that leads to the over-read.

Any Linux system whose kernel implements dm-verity with FEC support and that has not applied the patch contained in commit 3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb. The flaw manifests only for non‑default fec_roots, block size, and buffer allocation; the most common vulnerable case is block_size of 4096 with fec_roots set to 17, 19, 21, or 23 and a low number of buffers available (e.g., 1, 3, 5, 15, 1‑229, etc.). Any administrator or firmware that configures dm‑verity with these parameters may expose the system to the over‑read.

The CVSS score has not been issued and the EPSS data is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a configuration that leads to insufficient buffer allocation for the parity data, which may be achieved by selecting non‑default fec_roots values or by creating low‑memory conditions that prevent allocation of the necessary buffers. Once the out‑of‑bounds read occurs, it could potentially expose kernel memory contents or destabilize the system, though the exact impact depends on the execution context. The overall risk is therefore limited by the difficulty of meeting the preconditions for the boundary case and by the local nature of the vulnerability.