CVE-2026-99063
Received
Received - Intake
Buffer Overflow in Linux Kernel Device Mapper
Vulnerability report for CVE-2026-99063, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
dm ioctl: don't let data_start run past the buffer
struct dm_ioctl has seven bytes of trailing padding, so the smallest
buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),
is seven bytes shorter than sizeof(struct dm_ioctl).
get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without
looking at how big the buffer actually is. Ask for the minimum and
data_start ends up seven bytes past the end. Callers add it to
data_size, and ctl_ioctl() copies that much back to userspace:
BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0
Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140
ctl_ioctl+0x5e3/0xcb0
dm_ctl_ioctl+0x25/0x40
allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)
A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the
seven bytes that leak are whatever sat next to the allocation.
Clamp data_start to the buffer size.
Note that this is not a security bug because the out-of-bounds read can
only be triggered by root.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 76c072b48e39e9291fbf02d6c912cf27d65e093d |
| Linux | Linux | 76c072b48e39e9291fbf02d6c912cf27d65e093d |
| Linux | Linux | 76c072b48e39e9291fbf02d6c912cf27d65e093d |
| Linux | Linux | 76c072b48e39e9291fbf02d6c912cf27d65e093d |
| Linux | Linux | 76c072b48e39e9291fbf02d6c912cf27d65e093d |
| Linux | Linux | 2.6.25 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
