248 lines
12 KiB
JSON
248 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-99063",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.388Z",
|
|
"datePublished": "2026-10-23T12:23:04.655Z",
|
|
"dateUpdated": "2026-10-30T12:41:27.735Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:41:27.735Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don't let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140\n ctl_ioctl+0x5e3/0xcb0\n dm_ctl_ioctl+0x25/0x40\n allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)\n\nA DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the\nseven bytes that leak are whatever sat next to the allocation.\n\nClamp data_start to the buffer size.\n\nNote that this is not a security bug because the out-of-bounds read can\nonly be triggered by root."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/md/dm-ioctl.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "aaa93e41ae308ad9ff9d9ba3296a0d0f4d45bad3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "f171054f3c4cfc4dc0cb622ec5b15793e5f23029",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "afe80ec31464f4c54cc1bc658753bc14cb14bd6c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "98195e822343a656b92e235847ab3e72b1a3f920",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "e5c3f3d8935ecc64c962fb66e6a86dbf79218f61",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "5680b6fb3054677d4ee65d3baba24b649f1b430e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "725b49c689bbb29ef740b0d6b5ea9390baa9a695",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
|
|
"lessThan": "9b3fcf519d370df94a56f3b272d9eddffffa5be8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/md/dm-ioctl.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.25",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.25",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.273",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.113",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.57",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.11",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.10.273"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.12.113"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "6.18.57"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.2.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.25",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/aaa93e41ae308ad9ff9d9ba3296a0d0f4d45bad3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f171054f3c4cfc4dc0cb622ec5b15793e5f23029"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/afe80ec31464f4c54cc1bc658753bc14cb14bd6c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/725b49c689bbb29ef740b0d6b5ea9390baa9a695"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9b3fcf519d370df94a56f3b272d9eddffffa5be8"
|
|
}
|
|
],
|
|
"title": "dm ioctl: don't let data_start run past the buffer",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |