CVE-2026-46070: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46070 Overview

CVE-2026-46070 is an out-of-bounds read vulnerability in the Linux kernel's md/raid5 subsystem. The flaw resides in the RAID5 journal recovery logic, specifically in r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb(). Both functions iterate over payloads inside a journal metadata block using on-disk payload size fields without validating them against the remaining space in the block.

A corrupted journal containing payload sizes that extend beyond the PAGE_SIZE boundary can trigger out-of-bounds reads when the kernel accesses payload fields or computes offsets. The issue has been resolved upstream by adding bounds validation for each payload type before processing.

Critical Impact
A maliciously crafted or corrupted RAID5 journal can cause the kernel to read beyond the metadata block, potentially leading to information disclosure or kernel instability during array recovery.

Affected Products

Linux kernel versions containing the md/raid5 journal recovery code prior to the fix
Systems using RAID5 with a write-journal device (md-cluster / raid5-cache enabled arrays)
Distributions shipping the affected drivers/md/raid5-cache.c implementation

Discovery Timeline

2026-05-27 - CVE-2026-46070 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46070

Vulnerability Analysis

The Linux kernel md/raid5 driver supports a write-back cache backed by a journal device. During recovery, the kernel walks a chain of metadata blocks, each containing one or more payload descriptors that describe data or parity updates. The recovery code reads each payload's size directly from disk and uses it to advance a cursor through the metadata block.

Because the on-disk payload size is attacker-controlled when the journal is corrupted, the cursor can be advanced past the end of the PAGE_SIZE metadata block. Subsequent dereferences of payload header fields, or arithmetic that computes the next payload offset, then read memory outside the allocated page. This is an out-of-bounds read [CWE-125] in kernel context.

Root Cause

The root cause is missing input validation. Both r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() trust the payload size fields stored in the journal. They do not check whether the full payload fits within meta_size before reading payload type, location, and checksum fields. The upstream patch adds per-payload-type bounds checks to guarantee that the complete structure lies within the metadata block before it is parsed.

Attack Vector

Exploitation requires the ability to present a corrupted or attacker-controlled RAID5 journal to the kernel during array assembly or recovery. This typically means local access to the underlying journal block device, or supplying a malicious storage image to a system that auto-assembles MD arrays. Successful triggering causes kernel out-of-bounds reads, which can leak adjacent memory contents into checksum computations or destabilize the recovery path.

No verified public exploit code is available. The vulnerability is described in prose only; see the upstream commits referenced below for the precise validation logic added by the maintainers.

Detection Methods for CVE-2026-46070

Indicators of Compromise

Kernel log messages from the md/raid5 subsystem reporting failed journal recovery, unexpected metadata sizes, or checksum mismatches during array assembly.
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads inside r5c_recovery_analyze_meta_block or r5l_recovery_verify_data_checksum_for_mb on kernels built with sanitizers enabled.
Unexpected RAID5 array assembly failures following presentation of new or untrusted journal devices.

Detection Strategies

Inventory kernels in use and compare them against the fixed versions referenced in the upstream stable commits (33698bd, 406aa86, 73ce72e, b0cc3ae, c3a1cf7).
Monitor dmesg and journald for md/raid5 and raid5-cache recovery errors, particularly on systems that import external storage.
Use file integrity monitoring on the journal block device to detect unexpected modifications outside of normal MD activity.

Monitoring Recommendations

Forward kernel logs to a central log platform and alert on md/raid5 recovery failures or repeated array assembly attempts.
Track kernel package versions across the fleet and flag hosts running unpatched releases for prioritized remediation.
Audit which hosts have RAID5 arrays configured with a write-journal, since only those code paths are reachable.

How to Mitigate CVE-2026-46070

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that incorporates the upstream fix.
Identify hosts using RAID5 with raid5-cache (write-journal) and prioritize them for patching.
Restrict local and physical access to systems that auto-assemble MD arrays from removable or shared storage.

Patch Information

The fix has been merged into the mainline kernel and backported to multiple stable trees. Refer to the following upstream commits, which add bounds validation for each payload type before processing:

Workarounds

Where patching is not immediately possible, avoid configuring RAID5 arrays with a write-journal device until the kernel can be updated.
Do not attach untrusted block devices to systems that auto-assemble MD arrays.
Disable automatic MD array assembly on hosts that import external storage from untrusted sources.

bash

# Verify the running kernel version against the fixed releases
uname -r

# List MD arrays and check whether a write-journal device is configured
cat /proc/mdstat
mdadm --detail /dev/md0 | grep -i journal

# Example: remove a write-journal device from a RAID5 array until patched
# (run only after confirming array state is clean)
mdadm /dev/md0 --remove journal