CVE-2026-46023: Linux Kernel Privilege Escalation Flaw

CVE-2026-46023 Overview

CVE-2026-46023 is an integer overflow vulnerability in the Linux kernel's device mapper (dm) mirror target. The flaw resides in the create_dirty_log() function, where the argument count calculation *args_used = 2 + param_count executes before validation against argc. When a user supplies a param_count close to UINT_MAX through the device mapper table string, the unsigned addition wraps around to a small value. This bypasses the subsequent argc < *args_used bounds check. The overflowed param_count is then passed as argc to dm_dirty_log_create(), leading to out-of-bounds reads on the argv array.

Critical Impact
A local user with privileges to load device mapper tables can trigger out-of-bounds memory reads in the kernel, potentially leading to information disclosure or denial of service.

Affected Products

Linux kernel — dm-mirror device mapper target
Multiple stable kernel branches receiving the backported fix
Distributions packaging affected kernel versions until patches are applied

Discovery Timeline

2026-05-27 - CVE-2026-46023 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46023

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the create_dirty_log() function within the device mapper mirror target. The function calculates the number of consumed arguments by adding 2 + param_count and stores the result in *args_used. Because param_count is an unsigned value parsed from user-controlled device mapper table input, supplying a value near UINT_MAX causes the addition to wrap around to a small unsigned integer. The validation check argc < *args_used then succeeds incorrectly because the wrapped value is smaller than the actual argument count.

Once validation is bypassed, the original large param_count is passed unchanged to dm_dirty_log_create() as its argc parameter. That function iterates over the argv array using the inflated count, reading kernel memory well beyond the bounds of the supplied argument array.

Root Cause

The root cause is unchecked arithmetic on an attacker-influenced unsigned integer prior to a bounds check. The code performs the addition first and validates afterward, inverting the safe ordering. The corrected pattern, already used by parse_features() in the same source file, compares param_count against argc - 2 before any addition. Since argc >= 2 is guaranteed at that point, the subtraction is safe and prevents wraparound.

Attack Vector

Exploitation requires the ability to create device mapper devices, typically restricted to privileged users or processes with CAP_SYS_ADMIN. An attacker constructs a dm-mirror table string containing a crafted param_count value near UINT_MAX. When the kernel parses the table, the overflow triggers and dm_dirty_log_create() reads beyond the argv buffer. The out-of-bounds read can leak adjacent kernel memory contents or cause a kernel oops, resulting in denial of service.

No public proof-of-concept code is available. The fix is documented in upstream Linux kernel commits, including Linux Kernel Commit 17a08791 and Linux Kernel Commit 35f6b328.

Detection Methods for CVE-2026-46023

Indicators of Compromise

Unexpected kernel oops or panic messages referencing dm_dirty_log_create or create_dirty_log in dmesg output.
Audit log entries showing unprivileged or unexpected processes invoking ioctl(DM_TABLE_LOAD) against /dev/mapper/control.
Device mapper table strings containing abnormally large numeric arguments for mirror log parameters.

Detection Strategies

Monitor kernel logs for crashes or warnings originating in drivers/md/dm-log.c and the dm-mirror code paths.
Audit dmsetup create and dmsetup load invocations, capturing the full table string for review.
Track loaded kernel modules and compare running kernel versions against vendor advisories for the dm-mirror fix.

Monitoring Recommendations

Enable Linux audit rules for device mapper ioctls and forward events to a centralized logging platform.
Alert on repeated kernel crashes on hosts that perform storage management or container orchestration.
Inventory hosts using dm-mirror or RAID1 device mapper targets so patch deployment can be prioritized.

How to Mitigate CVE-2026-46023

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available.
Identify systems using dm-mirror targets through dmsetup table and prioritize them for kernel updates.
Restrict CAP_SYS_ADMIN and access to /dev/mapper/control to trusted administrative accounts only.

Patch Information

The fix changes the argument validation order in create_dirty_log() to compare param_count against argc - 2 before performing the addition, matching the safe pattern used by parse_features(). The fix is available in the following upstream commits: Linux Kernel Commit 17a08791, Linux Kernel Commit 35f6b328, Linux Kernel Commit 47dad9ee, Linux Kernel Commit 4c788c6f, and Linux Kernel Commit 87c99a50. Consult your distribution vendor for the corresponding backported package version.

Workarounds

Avoid using the dm-mirror target where possible; consider migrating mirrored volumes to dm-raid or LVM RAID alternatives.
Constrain container and virtualization workloads so untrusted tenants cannot invoke device mapper ioctls.
Disable loading of the dm-mirror and dm-log modules on hosts that do not require them by blacklisting in /etc/modprobe.d/.

bash

# Blacklist dm-mirror and dm-log modules where not needed
echo 'blacklist dm_mirror' | sudo tee /etc/modprobe.d/dm-mirror.conf
echo 'blacklist dm_log'    | sudo tee -a /etc/modprobe.d/dm-mirror.conf
sudo update-initramfs -u

# Verify whether dm-mirror is currently loaded
lsmod | grep -E 'dm_mirror|dm_log'

# List active device mapper targets to identify mirror usage
sudo dmsetup table | awk '{print $4}' | sort -u