CVE-2026-46023 dm mirror: fix integer overflow in create_dirty_log()
An integer overflow in the Linux kernel's device mapper mirror allows out-of-bounds reads, potentially leading to information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46023?
CVE-2026-46023 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm mirror: fix integer overflow in create_dirty_log()
The argument count calculation in create_dirty_log() performs `*args_used = 2 + param_count` before validating against argc. When a user provides a param_count close to UINT_MAX via the device mapper table string, this unsigned addition wraps around to a small value, causing the subsequent `argc < *args_used` check to be bypassed.
The overflowed param_count is then passed as argc to dm_dirty_log_create(), where it can cause out-of-bounds reads on the argv array.
Fix by comparing param_count against argc - 2 before performing the addition, following the same pattern used by parse_features() in the same file. Since argc >= 2 is already guaranteed, the subtraction is safe.
Weakness: CWE-190
Which versions are affected by CVE-2026-46023?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46023?
Apply the vendor's patch.
Is CVE-2026-46023 being exploited?
There is no known exploitation of CVE-2026-46023 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88574, BELL-CVE-2026-46023, DEBIAN-CVE-2026-46023, GHSA-f54w-pgr9-9wv8, ROOT-OS-DEBIAN-11-CVE-2026-46023, ROOT-OS-DEBIAN-12-CVE-2026-46023 and 3 more.