CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: don't let data start run past the buffer

struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm ioctl, data), is seven bytes shorter than sizeof(struct dm ioctl).

get result buffer() sets data start to sizeof(struct dm ioctl) without looking at how big the buffer actually is. Ask for the minimum and data start ends up seven bytes past the end. Callers add it to data size, and ctl ioctl() copies that much back to userspace:

BUG: KASAN: slab-out-of-bounds in copy to user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl ioctl+0x5e3/0xcb0 dm ctl ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)

A DM LIST DEVICES with data size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation.

Clamp data start to the buffer size.

Note that this is not a security bug because the out-of-bounds read can only be triggered by root.