CVE-2026-99063 dm ioctl: don't let data_start run past the buffer
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99063?
CVE-2026-99063 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm ioctl: don't let data_start run past the buffer
struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl).
get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace:
BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)
A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation.
Clamp data_start to the buffer size.
Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
Which versions are affected by CVE-2026-99063?
How do I fix CVE-2026-99063?
Upgrade to a fixed version.
Is CVE-2026-99063 being exploited?
There is no known exploitation of CVE-2026-99063 in the wild and no public exploit code.
Sources
Also known as AZL-110954, BELL-CVE-2026-99063, DEBIAN-CVE-2026-99063, GHSA-vqpj-f54g-hrc3, UBUNTU-CVE-2026-99063.