CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log()
dm mirror: fix integer overflow in createdirtylog()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel device-mapper dm-mirror component are exposed. The affected software list also includes Microsoft azl3 kernel 6.6.139.1-1.
What must an attacker be able to do to exploit it?
An attacker needs the ability to supply a crafted device-mapper table string with a param_count close to UINT_MAX. The vulnerable path is in dm-mirror dirty-log creation.
What is the impact of successful exploitation?
The integer overflow can bypass argument-count validation and cause dm_dirty_log_create() to read beyond the argv array. The provided severity vector indicates low confidentiality impact and low availability impact, with no integrity impact.
How can I determine whether a system is affected?
Determine whether the running kernel includes the dm-mirror create_dirty_log() fix that validates param_count against argc - 2 before adding 2. The provided references identify stable kernel commits containing the fix.