Intel

CVE-2026-46294

Security update for the Linux Kernel

highEPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved:

dm: fix a buffer overflow in ioctl processing

Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:

  1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there
  2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr);
  3. The alignment doesn't check overflow, so outptr could point past the buffer end
  4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf);
  5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number
  6. With "remaining" being high, the code writes more data past the end of the buffer

Luckily, this bug has no security implications because:

  1. Only root can issue device mapper ioctls
  2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally
Source: SUSE_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNBSIBSI_CSAFCVELISTV5NVDCVEORG

Metrics

Severity
high
Priority score
238.98
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
3.9 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
EPSS score
0.1 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-12 11:31 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 08:10 UTC· nvd@nist.gov
    • Translation: Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: dm: corrige un desbordamiento de búfer en el procesamiento de ioctl Tony Asleson (usando Claude) encontró un desbordamiento de búfer en dm-ioctl en la función retrieve_status: 1. El código en retrieve_status verifica que la cadena de salida cabe en el búfer de salida y escribe la cadena de salida allí 2. Luego, el código alinea la variable 'outptr' al siguiente límite de 8 bytes: outptr = align_ptr(outptr); 3. La alineación no verifica el desbordamiento, por lo que 'outptr' podría apuntar más allá del final del búfer 4. El bucle 'for' se itera de nuevo, ejecuta: remaining = len - (outptr - outbuf); 5. Si 'outptr' apunta más allá de 'outbuf + len', la aritmética se desborda y la variable 'remaining' contiene un número inusualmente alto 6. Siendo 'remaining' alto, el código escribe más datos más allá del final del búfer Afortunadamente, este error no tiene implicaciones de seguridad porque: 1. Solo root puede emitir ioctls del mapeador de dispositivos 2. Las bibliotecas comúnmente utilizadas que se comunican con el mapeador de dispositivos (libdevmapper y devicemapper-rs) usan un tamaño de búfer que está alineado a 8 bytes; por lo tanto, 'outptr = align_ptr(outptr)' no puede exceder el búfer de entrada y el error no puede ocurrir accidentalmente
  2. New CVE Received2026-06-08 17:16 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
    • Description: In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally
    • Reference: https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159
    • Reference: https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
    • Reference: https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux_aus8.6

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_eus9.4

  • linux

    redhat / enterprise_linux_eus9.6

  • linux

    redhat / enterprise_linux_eus8.4

  • linux

    redhat / enterprise_linux_eus10.0

  • linux

    redhat / enterprise_linux_tus8.6

  • linux

    redhat / enterprise_linux_tus8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.0

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.6

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.2

  • linux

    opensuse / leap15.5

  • linux

    opensuse / leap15.4

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • redhat

    openshift_container_platform4.12 – 4.12.89

  • redhat

    openshift_container_platform4.13 – 4.13.66

  • redhat

    openshift_container_platform4.14 – 4.14.65

  • redhat

    openshift_container_platform4.15 – 4.15.64

  • redhat

    openshift_container_platform4.16 – 4.16.61

  • redhat

    openshift_container_platform4.17 – 4.17.53

  • redhat

    openshift_container_platform4.18 – 4.18.40

  • redhat

    openshift_container_platform4.19 – 4.19.30

  • redhat

    openshift_container_platform4.20 – 4.20.21

  • redhat

    openshift_container_platform4.21 – 4.21.14

  • redhat

    openshift_container_platform

  • siemens

    simatic_ax_runtime

  • suse

    caas_platform

  • suse

    enterprise_storage

  • suse

    manager_proxy

  • suse

    manager_retail_branch_server

  • suse

    manager_server

  • suse

    openstack_cloud

  • suse

    openstack_cloud_crowbar

References & sources

Linked CVEs

Show 164 more CVEs
IDCVE-2026-46294