CVE-2026-46130

Technical summary

The fec_decode_bufs() function in dm-verity-fec incorrectly assumes parity bytes for Reed-Solomon codewords never straddle parity block boundaries. When v->fec->block_size equals 4096, v->fec->roots is set to non-default values (17, 19, 21, or 23), and buffer allocation is constrained due to memory pressure, the byte alignment calculation (272*i mod 4096, for example) can position parity data such that required bytes extend beyond the current block. The function then reads out-of-bounds from the parity block buffer. The CWE-125 out-of-bounds read occurs because the parsing logic does not account for block-boundary wraparound when handling split codewords.

Business impact

This vulnerability primarily affects systems using dm-verity for filesystem integrity verification, commonly found in containerized environments, secure boot chains, and embedded Linux devices. Exploitation could leak sensitive kernel memory contents or trigger denial-of-service through kernel crashes or hangs. The practical attack surface is narrow: an attacker with local access and the ability to configure non-default fec_roots parameters and induce memory pressure would be required. Most production deployments use default settings, significantly limiting real-world exposure. However, specialized use cases (Android devices, Chrome OS, container runtimes with custom dm-verity profiles) may warrant closer evaluation.

Affected systems

All Linux kernel versions contain this vulnerability. Systems using dm-verity with fec_roots values of 17, 19, 21, or 23 and buffer counts in specific ranges are affected: fec_roots=17 with nbufs in [1, 3, 5, 15]; fec_roots=19 with nbufs in [1, 229]; fec_roots=21 with nbufs in [1, 3, 5, 13, 15, 39, 65, 195]; fec_roots=23 with nbufs in [1, 89]. Default kernel configurations (typically fec_roots=2) are not vulnerable. Affected platforms include Android devices, Chrome OS, enterprise container hosts, and custom embedded Linux distributions that explicitly enable forward error correction with non-standard roots.

Exploitability

Exploitation requires local code execution with sufficient privileges to interact with dm-verity parity data. The vulnerability cannot be exploited remotely. An attacker must induce specific memory allocation conditions while the kernel processes dm-verity blocks with the vulnerable parameter combinations. Practical exploitation for information disclosure is possible but requires precise timing and environment setup. The narrow trigger conditions and requirement for privileged local access limit the severity in typical deployments. No public exploits are known, and the vulnerability is not tracked in active exploitation databases.

Remediation

Apply kernel updates that refactor parity block reading logic to correctly handle split codewords across block boundaries. Verify the patch resolves the issue for your specific fec_roots configuration. As an interim mitigation, review dm-verity configurations and revert fec_roots to default values (typically 2) if non-standard settings were intentionally enabled. Ensure adequate memory availability on systems using dm-verity to reduce the likelihood of the constrained buffer allocation scenario. Implement memory monitoring and alerting to detect low-memory conditions.

Patch guidance

Check your Linux distribution's kernel security advisory for the specific patch version addressing CVE-2026-46130. Canonical, Red Hat, SUSE, and other major distributors will backport the fix across supported kernel versions. For custom kernels, apply the upstream fix that refactors fec_decode_bufs() to properly handle parity byte boundaries. Testing should confirm the patch applies cleanly to your kernel version and that dm-verity continues to function correctly with your fec_roots configuration. Coordinate patching with any other dm-verity-dependent systems (e.g., container orchestration platforms) to ensure coordinated updates.

Detection guidance

Monitor kernel logs for dm-verity errors or out-of-bounds memory access warnings coinciding with fec_roots configuration values outside the default range. Use KASAN (Kernel Address Sanitizer) or similar memory debugging tools in test environments to confirm the vulnerability is present before patching. Observe memory allocation patterns under load; if buffer allocation consistently fails and falls back to lower buffer counts on your dm-verity deployment, you may hit the vulnerable code path. Audit dm-verity mount parameters across your infrastructure to identify systems with non-default fec_roots values.

Why prioritize this

Although the CVSS score of 7.1 (HIGH) reflects the severity of out-of-bounds reads and potential denial-of-service, the practical attack surface is substantially narrower. The vulnerability requires both non-default kernel configuration choices and local privileged access, combined with specific memory constraints. Prioritize patching if your organization uses Android, Chrome OS, or custom embedded deployments with explicitly configured fec_roots parameters. Standard Linux server and container deployments using default dm-verity settings can deprioritize this vulnerability relative to other HIGH-severity issues affecting default configurations. However, do not defer indefinitely; schedule patching within your normal security update cycle once vendor patches are available.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH severity due to the combination of high confidentiality impact (kernel memory disclosure), high availability impact (potential system crash), low privileges required for local attack, and no user interaction needed once access is obtained. However, the 'AC:L' (low attack complexity) in the CVSS vector is tempered by the non-default configuration requirement and memory pressure preconditions, which reduce real-world exploitability. The score appropriately reflects the technical severity of the vulnerability but should be contextualized with your own risk assessment of whether your systems are configured with vulnerable fec_roots parameters.

Frequently asked questions