CVE-2026-46294

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dm: fix a buffer overflow in ioctl processing<br /> <br /> Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the<br /> function retrieve_status:<br /> <br /> 1. The code in retrieve_status checks that the output string fits into<br /> the output buffer and writes the output string there<br /> 2. Then, the code aligns the "outptr" variable to the next 8-byte<br /> boundary:<br /> outptr = align_ptr(outptr);<br /> 3. The alignment doesn&amp;#39;t check overflow, so outptr could point past the<br /> buffer end<br /> 4. The "for" loop is iterated again, it executes:<br /> remaining = len - (outptr - outbuf);<br /> 5. If "outptr" points past "outbuf + len", the arithmetics wraps around<br /> and the variable "remaining" contains unusually high number<br /> 6. With "remaining" being high, the code writes more data past the end of<br /> the buffer<br /> <br /> Luckily, this bug has no security implications because:<br /> 1. Only root can issue device mapper ioctls<br /> 2. The commonly used libraries that communicate with device mapper<br /> (libdevmapper and devicemapper-rs) use buffer size that is aligned to<br /> 8 bytes - thus, "outptr = align_ptr(outptr)" can&amp;#39;t overshoot the input<br /> buffer and the bug can&amp;#39;t happen accidentally