https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:38:41 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46294 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm: fix a buffer overflow in ioctl processing</p> <p>Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status:</p> <p>1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the &#34;outptr&#34; variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn&#39;t check overflow, so outptr could point past the buffer end 4. The &#34;for&#34; loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If &#34;outptr&#34; points past &#34;outbuf + len&#34;, the arithmetics wraps around and the variable &#34;remaining&#34; contains unusually high number 6. With &#34;remaining&#34; being high, the code writes more data past the end of the buffer</p> <p>Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, &#34;outptr = align_ptr(outptr)&#34; can&#39;t overshoot the input buffer and the bug can&#39;t happen accidentally</p> https://vulnerability.circl.lu/vuln/cve-2026-46294