CVE-2026-46070 Details
Description
In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing.
A vulnerability in the Linux kernel's RAID5 journal metadata handling has been addressed. The issue arose because certain recovery functions processed payloads using on-disk size fields without verifying them against the available space in the metadata block. This oversight could lead to out-of-bounds reads, particularly when a journal was corrupted and contained payload sizes exceeding the PAGE_SIZE limit. The vulnerability has been mitigated by introducing proper bounds validation for each payload type, ensuring that all data fits within the designated metadata size before any processing occurs.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/28d3ff7109c66e99dc1b7cddacb5c760849620ef | kernel.org | Patch |
| https://git.kernel.org/stable/c/33698bd1b2db9764a29df7751533d33967ff5c98 | kernel.org | Patch |
| https://git.kernel.org/stable/c/406aa86394ead347c47428fb51b6359bdaa2257d | kernel.org | Patch |
| https://git.kernel.org/stable/c/73ce72edd113374801045924d4417199963f73a3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e | kernel.org | Patch |
| https://git.kernel.org/stable/c/c96c6f01d84b5c67db1bf1cc8591c0b7146826fc | kernel.org | Patch |
| https://git.kernel.org/stable/c/ef4851d8324fd978ca1ff9ec76a275438f887743 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.10, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |