CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3)
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to be affected by this issue?
Systems using dm-verity FEC with certain non-default fec_roots values are affected under the described conditions. The issue also requires failure to allocate the maximum number of buffers, such as during low-memory conditions.
Is the default dm-verity FEC configuration normally exposed?
No. The vulnerability description states that this does not normally occur because it requires certain non-default fec_roots values in addition to constrained buffer allocation.
What conditions trigger the out-of-bounds read?
The parity bytes needed for Reed-Solomon decoding must cross a parity-block boundary while fec_decode_bufs() assumes they remain in one block. The provided example uses a 4096-byte block size, 17 roots, one buffer, and reaches the boundary condition on the 16th call.
What is the impact when the condition occurs?
The code reads out of bounds from a parity-block buffer. The supplied severity vector indicates local access with low attack complexity and low privileges, with high confidentiality and availability impact.