In the Linux kernel, the following vulnerability has been resolved:

dm array: validate array block headers on read

array block check() validates blocknr and csum and nothing else, while node check(), next to it, has bounded the structural fields since both were written. dm array cursor next() takes its loop bound from the on-disk nr entries and element at() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dm cache load mappings() drives it once per cache block at activation.

Check the header against itself: reject a zero value size, require max entries to equal calc max entries() for that value size and block size, and require nr entries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUG ON() in fill ablock() and trim ablock(). Metadata dm-array writes satisfies all three.