The Linux kernel device mapper's array code had a vulnerability where array_block_check() did not properly validate that the value size of an array block matched the caller's expected value size. This allowed a block with a mismatched value size to appear internally consistent and pass checks. Specifically, dm-cache maintains two arrays with different value sizes (8 bytes for mappings and 4 bytes for hints), and the roots for both reside in the superblock. If the mappings root points to a hint block, __load_mappings() incorrectly strides over 4-byte entries as if they were 8 bytes, causing out-of-bounds access. The fix involves rejecting blocks when the value sizes disagree in get_ablock() and __shadow_ablock(), preventing crafted metadata from being accepted.

The vulnerability could allow crafted metadata to bypass internal consistency checks in the device mapper's array handling, potentially leading to out-of-bounds memory access during dm-cache mapping loading. This could cause memory corruption or instability in the kernel's device mapper subsystem. However, exploitation requires crafted metadata and the arrays only read their own blocks, limiting the scope of impact.

A fix has been implemented in the Linux kernel to reject array blocks when the value size does not match the caller's expected size in get_ablock() and __shadow_ablock(). Users should apply the official kernel updates that include this fix. No additional mitigation is indicated beyond applying the patch.