CVE-2026-46294 - Vulnerability Details

- dm: fix a buffer overflow in ioctl processing

Description

In the Linux kernel, the following vulnerability has been resolved:

dm: fix a buffer overflow in ioctl processing

Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the
function retrieve_status:

1. The code in retrieve_status checks that the output string fits into
the output buffer and writes the output string there
2. Then, the code aligns the "outptr" variable to the next 8-byte
boundary:
outptr = align_ptr(outptr);
3. The alignment doesn't check overflow, so outptr could point past the
buffer end
4. The "for" loop is iterated again, it executes:
remaining = len - (outptr - outbuf);
5. If "outptr" points past "outbuf + len", the arithmetics wraps around
and the variable "remaining" contains unusually high number
6. With "remaining" being high, the code writes more data past the end of
the buffer

Luckily, this bug has no security implications because:
1. Only root can issue device mapper ioctls
2. The commonly used libraries that communicate with device mapper
(libdevmapper and devicemapper-rs) use buffer size that is aligned to
8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input
buffer and the bug can't happen accidentally

Published: 2026-06-08

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a buffer overflow in the Linux kernel's device mapper ioctl handler function retrieve_status. The routine aligns an output pointer to the next 8‑byte boundary without checking bounds, which can cause the pointer to advance past the allocated buffer and allow subsequent writes to overwrite memory beyond the intended region. The flaw may only be triggered by root‑privileged requests, so non‑privileged users cannot exploit it directly.

Affected Systems

The flaw exists in the device mapper subsystem of the Linux kernel and affects all kernel installations that have not integrated the upstream commit that patches the overflow. Administrators should verify that their kernel package includes the latest patch set or upgrade to a distribution release that contains the fix.

Risk and Exploitability

The CVSS score of 7.0 indicates medium severity, reflecting the risk of kernel memory corruption when a root user issues a malformed ioctl. The EPSS metric is unavailable and the vulnerability is not in the CISA KEV catalog, suggesting no known widespread exploitation yet. Attackers with root privileges could intentionally craft unaligned buffers to trigger the overflow, potentially overwriting kernel memory; however, typical library usage aligns buffers to 8‑byte boundaries, reducing the likelihood of accidental exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c8c5311237448f6ffeecc9aec2362e3692623668
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 526ff9126a0ae087b65726e1faf31114c718020d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d271631023cbe1cbe7c31a0275ab797883be6e0a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5af6a879e915ae7bcd83695c316ebb32e1c61bc2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8daa6c708ef524089ae43f2aed9190acb26d7df8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2fa49cc884f6496a915c35621ba4da35649bf159

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.88`	unaffected	≤ 6.12.*
`6.18.30`	unaffected	≤ 6.18.*
`7.0.7`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c8c5311237448f6ffeecc9aec2362e3692623668)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,526ff9126a0ae087b65726e1faf31114c718020d)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d271631023cbe1cbe7c31a0275ab797883be6e0a)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5af6a879e915ae7bcd83695c316ebb32e1c61bc2)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8daa6c708ef524089ae43f2aed9190acb26d7df8)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2fa49cc884f6496a915c35621ba4da35649bf159)`	affected	generic	—
`[0,5.10.258)`	affected	semver	—
`[0,5.15.209)`	affected	semver	—
`[0,6.1.175)`	affected	semver	—
`[0,6.6.140)`	affected	semver	—
`[0,6.12.88)`	affected	semver	—
`[0,6.18.30)`	affected	semver	—
`[0,7.0.7)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0,5.10.*]`	unaffected	semver	—
`[0,5.15.*]`	unaffected	semver	—
`[0,6.1.*]`	unaffected	semver	—
`[0,6.6.*]`	unaffected	semver	—
`[0,6.12.*]`	unaffected	semver	—
`[0,6.18.*]`	unaffected	semver	—
`[0,7.0.*]`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that fixes the dm ioctl buffer overflow, ensuring the system is running a version that includes the upstream commit.
Reboot the machine to activate the updated kernel and apply the patch.
Limit root access by enforcing the principle of least privilege or restricting capabilities that allow device mapper ioctl calls.

Generated by OpenCVE AI on June 9, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00195.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159
https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d
https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2
https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8
https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668
https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a
https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a
https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46294-dcc8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46294
https://www.cve.org/CVERecord?id=CVE-2026-46294

History

Tue, 09 Jun 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120

Tue, 09 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
References		https://lore.kernel.org/linux-cve-announce/2026060857-CVE-2026-46294-dcc8@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46294 https://www.cve.org/CVERecord?id=CVE-2026-46294
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Mon, 08 Jun 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120

Mon, 08 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally
Title		dm: fix a buffer overflow in ioctl processing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159 https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2 https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8 https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668 https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-08T15:46:21.401Z

Updated: 2026-06-14T18:07:06.194Z

Reserved: 2026-05-13T15:03:33.110Z

Link: CVE-2026-46294

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-06-08T17:16:47.757

Modified: 2026-06-08T17:16:47.757

Link: CVE-2026-46294

Redhat

Severity : Moderate

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-46294 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-09T03:45:26Z

Weaknesses

CWE-190
Integer Overflow or Wraparound

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object