EUVD-2026-76485
GHSA-pg3h-8qxx-35hj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires CAP_SYS_ADMIN to configure dm-cache devices and crafted metadata to trigger the mismatch, warranting PR:H and AC:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
dm array: reject an array block whose value size is not the caller's
array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block.
get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
AnalysisAI
Out-of-bounds kernel memory access in the Linux kernel device-mapper (dm array) library allows a local attacker with crafted dm-cache metadata to trigger an 8-byte stride over 4-byte entries, computing element offsets up to 8160 bytes within a 4096-byte block. The root cause is that array_block_check() validates a block's internal self-consistency but never compares the stored value_size against the calling context's expected value_size; dm-cache's two persistent arrays (mappings at 8 bytes, hints at 4 bytes) share the same on-disk format, so a superblock pointing the mappings root at a hint block silently passes validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to present crafted dm-cache block-device metadata to the kernel - specifically a superblock where the mappings array root pointer is redirected to a hints array block. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream kernel patches: for the 6.12.y stable series update to 6.12.109 or later (commit ac4a5eb8b002); for the 6.18.y series update to 6.18.50 or later (commit cb409b38b023); for the 7.2.y series update to 7.2.4 or later (commit 7bf4b5cb42a4); for the 7.3 development branch pick commit 4538a287bdf5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems running the Linux kernel with dm-cache enabled by reviewing storage configuration and checking dmsetup table output. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today