CVE-2026-46070

Analyzed Analyzed - Analysis Complete

Kernel Out-of-Bounds Read in MD RAID5 Journal Metadata Handling

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46070

EUVD

EUVD-2026-32452

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 4.10 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's md/raid5 component, specifically in how it handles journal metadata payload sizes. Functions r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads using on-disk payload size fields without validating these sizes against the remaining space in the metadata block.

If the journal is corrupted and contains payload sizes that extend beyond the PAGE_SIZE boundary, this can lead to out-of-bounds reads when accessing payload fields or computing offsets. The fix involves adding bounds validation for each payload type to ensure the full payload fits within the metadata size before processing.

Impact Analysis

This vulnerability can cause out-of-bounds reads in the Linux kernel when processing corrupted RAID5 journal metadata. Such out-of-bounds reads may lead to system instability, crashes, or potentially expose sensitive kernel memory contents, which could be exploited by attackers to compromise system security.

Hi! I’m here to help you understand CVE-2026-46070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70