CVE-2026-46070
Published: May 27, 2026
Modified: Jun 1, 2026
CVSS v3.1
7.1
Description
In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing.
| Vendor | Product | Versions |
|---|---|---|
Linux | Linux | affected b4c625c67362b3940f619c1a836b4e8329106658 - < c96c6f01d84b5c67db1bf1cc8591c0b7146826fcaffected b4c625c67362b3940f619c1a836b4e8329106658 - < ef4851d8324fd978ca1ff9ec76a275438f887743affected b4c625c67362b3940f619c1a836b4e8329106658 - < 28d3ff7109c66e99dc1b7cddacb5c760849620efaffected b4c625c67362b3940f619c1a836b4e8329106658 - < 33698bd1b2db9764a29df7751533d33967ff5c98affected b4c625c67362b3940f619c1a836b4e8329106658 - < c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e+3 more versions |
Linux | Linux | affected 4.10unaffected 0 - < 4.10unaffected 5.10.258 - <= 5.10.*unaffected 5.15.209 - <= 5.15.*unaffected 6.1.175 - <= 6.1.*+5 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now