CVE-2026-99063
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl). get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace: BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31) A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation. Clamp data_start to the buffer size. Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-23 13:17:30.140000
Last modified
2026-10-30 13:21:43.040000
View original CVE JSON
{
"id": "CVE-2026-99063",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T13:17:30.140",
"lastModified": "2026-10-30T13:21:43.040",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140\n ctl_ioctl+0x5e3/0xcb0\n dm_ctl_ioctl+0x25/0x40\n allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)\n\nA DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the\nseven bytes that leak are whatever sat next to the allocation.\n\nClamp data_start to the buffer size.\n\nNote that this is not a security bug because the out-of-bounds read can\nonly be triggered by root."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "aaa93e41ae308ad9ff9d9ba3296a0d0f4d45bad3",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "f171054f3c4cfc4dc0cb622ec5b15793e5f23029",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "afe80ec31464f4c54cc1bc658753bc14cb14bd6c",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "98195e822343a656b92e235847ab3e72b1a3f920",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "e5c3f3d8935ecc64c962fb66e6a86dbf79218f61",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "5680b6fb3054677d4ee65d3baba24b649f1b430e",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "725b49c689bbb29ef740b0d6b5ea9390baa9a695",
"versionType": "git",
"status": "affected"
},
{
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"lessThan": "9b3fcf519d370df94a56f3b272d9eddffffa5be8",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.25",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.25",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.11",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/725b49c689bbb29ef740b0d6b5ea9390baa9a695",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b3fcf519d370df94a56f3b272d9eddffffa5be8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aaa93e41ae308ad9ff9d9ba3296a0d0f4d45bad3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/afe80ec31464f4c54cc1bc658753bc14cb14bd6c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f171054f3c4cfc4dc0cb622ec5b15793e5f23029",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}