Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99063— dm ioctl: don't let data_start run past the buffer

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： dm ioctl：防止 data_start 超出缓冲区范围 结构体末尾包含 7 字节的填充（padding），因此用户空间允许请求的最小缓冲区大小（即 ）比 小 7 个字节。 函数在设置 时直接使用了 ，而未考虑实际缓冲区的大小。当请求最小缓冲区时， 最终会超出缓冲区末尾 7 个字节。调用者会将该值加到 上，随后 会将相应数量的数据复制回用户空间： 只需将 设置为 305 字节的 请求即可触发此问题，泄露的 7 个字节即为该内存分配区域之后的任意数据。 修复方案：将

AI Predicted 4.4 Difficulty: Hard EPSS 0.17% · P6

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 76c072b48e39e9291fbf02d6c912cf27d65e093d< 98195e822343a656b92e235847ab3e72b1a3f920 affected
76c072b48e39e9291fbf02d6c912cf27d65e093d< e5c3f3d8935ecc64c962fb66e6a86dbf79218f61 affected
76c072b48e39e9291fbf02d6c912cf27d65e093d< 5680b6fb3054677d4ee65d3baba24b649f1b430e affected
76c072b48e39e9291fbf02d6c912cf27d65e093d< 725b49c689bbb29ef740b0d6b5ea9390baa9a695 affected
76c072b48e39e9291fbf02d6c912cf27d65e093d< 9b3fcf519d370df94a56f3b272d9eddffffa5be8 affected
2.6.25 affected
< 2.6.25 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99063

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
dm ioctl: don't let data_start run past the buffer
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl). get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without looking at how big the buffer actually is. Ask for the minimum and data_start ends up seven bytes past the end. Callers add it to data_size, and ctl_ioctl() copies that much back to userspace: BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0 Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140 ctl_ioctl+0x5e3/0xcb0 dm_ctl_ioctl+0x25/0x40 allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31) A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the seven bytes that leak are whatever sat next to the allocation. Clamp data_start to the buffer size. Note that this is not a security bug because the out-of-bounds read can only be triggered by root.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 76c072b48e39e9291fbf02d6c912cf27d65e093d ~ 98195e822343a656b92e235847ab3e72b1a3f920 -
Linux Linux 2.6.25 -

II. Public POCs for CVE-2026-99063

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99063

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99063 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99014 7.8 HIGH Bluetooth: hci_sync: Fix command skb lifetime during scan setup
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99018 7.8 HIGH riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux