CVE-2026-46130 dm-verity-fec: fix reading parity bytes split across blocks (take 3)
Out-of-bounds read in Linux kernel dm-verity-fec allows attackers to cause denial of service or potentially execute code under specific non-default configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46130?
CVE-2026-46130 is a high-severity memory corruption vulnerability in Linux kernel, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
fec_decode_bufs() assumes that the parity bytes of the first RS codeword it decodes are never split across parity blocks.
This assumption is false. Consider v->fec->block_size == 4096 && v->fec->roots == 17 && fio->nbufs == 1, for example. In that case, each call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs << DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.
Considering that the parity data for each message block starts on a block boundary, the byte alignment in the parity data will iterate through 272*i mod 4096 until the 3 parity blocks have been consumed. On the 16th call (i=15), the alignment will be 4080 bytes into the first block. Only 16 bytes remain in that block, but 17 parity bytes will be needed. The code reads out-of-bounds from the parity block buffer.
Fortunately this doesn't normally happen, since it can occur only for certain non-default values of fec_roots *and* when the maximum number of buffers couldn't be allocated due to low memory. For example with block_size=4096 only the following cases are affected:
fec_roots=17: nbufs in [1, 3, 5, 15] fec_roots=19: nbufs in [1, 229] fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195] fec_roots=23: nbufs in [1, 89]
Regardless, fix it by refactoring how the parity blocks are read.
Weakness: CWE-125
Which versions are affected by CVE-2026-46130?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46130?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46130 being exploited?
There is no known exploitation of CVE-2026-46130 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88935, BELL-CVE-2026-46130, DEBIAN-CVE-2026-46130, GHSA-6hvc-rwfc-mp4j, ROOT-OS-DEBIAN-12-CVE-2026-46130, ROOT-OS-DEBIAN-13-CVE-2026-46130 and 2 more.