CVE-2026-99063: dm ioctl: don't let data_start run past the buffer
In the Linux kernel, the following vulnerability has been resolved:
dm ioctl: don't let datastart run past the buffer
struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dmioctl, data), is seven bytes shorter than sizeof(struct dmioctl).
getresultbuffer() sets datastart to sizeof(struct dmioctl) without looking at how big the buffer actually is. Ask for the minimum and datastart ends up seven bytes past the end. Callers add it to datasize, and ctlioctl() copies that much back to userspace:
BUG: KASAN: slab-out-of-bounds in copytouser+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctlioctl+0x5e3/0xcb0 dmctlioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)
A DMLISTDEVICES with datasize set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation.
Clamp datastart to the buffer size.
Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Clamp data_start to the actual buffer size before copying data back to userspace, preventing it from running past the buffer.