CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log()

Q: Who is exposed to this issue?

Systems using the Linux kernel device-mapper dm-mirror component are exposed. The affected software list also includes Microsoft azl3 kernel 6.6.139.1-1.

Q: What must an attacker be able to do to exploit it?

An attacker needs the ability to supply a crafted device-mapper table string with a param_count close to UINT_MAX. The vulnerable path is in dm-mirror dirty-log creation.

Q: What is the impact of successful exploitation?

The integer overflow can bypass argument-count validation and cause dm_dirty_log_create() to read beyond the argv array. The provided severity vector indicates low confidentiality impact and low availability impact, with no integrity impact.

Q: How can I determine whether a system is affected?

Determine whether the running kernel includes the dm-mirror create_dirty_log() fix that validates param_count against argc - 2 before adding 2. The provided references identify stable kernel commits containing the fix.

Published May 27, 2026

Updated

dm mirror: fix integer overflow in createdirtylog()

Affected Software

14 affected componentsFixes available

Linux Linux kernel (device-mapper dm-mirror)

Linux Linux kernel>=2.6.12.1<5.10.258

Linux Linux kernel>=5.11<5.15.209

Linux Linux kernel>=5.16<6.1.175

Linux Linux kernel>=6.2<6.6.140

Linux Linux kernel>=6.7<6.12.86

Linux Linux kernel>=6.13<6.18.27

Linux Linux kernel>=6.19<7.0.4

Linux Linux kernel=2.6.12

Linux Linux kernel=2.6.12-rc2

Linux Linux kernel=2.6.12-rc3

Linux Linux kernel=2.6.12-rc4

Linux Linux kernel=2.6.12-rc5

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1

Event History

May 27, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

Description

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 28, 2026

Data Sourced

via Microsoft·08:11 AM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·08:11 AM

Affected Software

Updated

via Microsoft·08:11 AM

DescriptionSeverity

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel device-mapper dm-mirror component are exposed. The affected software list also includes Microsoft azl3 kernel 6.6.139.1-1.

What must an attacker be able to do to exploit it?

An attacker needs the ability to supply a crafted device-mapper table string with a param_count close to UINT_MAX. The vulnerable path is in dm-mirror dirty-log creation.

What is the impact of successful exploitation?

The integer overflow can bypass argument-count validation and cause dm_dirty_log_create() to read beyond the argv array. The provided severity vector indicates low confidentiality impact and low availability impact, with no integrity impact.

How can I determine whether a system is affected?

Determine whether the running kernel includes the dm-mirror create_dirty_log() fix that validates param_count against argc - 2 before adding 2. The provided references identify stable kernel commits containing the fix.

CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log()

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker be able to do to exploit it?

What is the impact of successful exploitation?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker be able to do to exploit it?

What is the impact of successful exploitation?

How can I determine whether a system is affected?