In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven… (CVE-2026-99063)

The Linux kernel's device mapper ioctl interface had a flaw where the data_start pointer was set to the size of struct dm_ioctl without verifying the actual buffer size requested by userspace. Because struct dm_ioctl contains seven bytes of trailing padding, the minimum buffer size userspace can request is seven bytes smaller than sizeof(struct dm_ioctl). This mismatch allowed data_start to point seven bytes beyond the buffer boundary, causing an out-of-bounds read when ctl_ioctl() copied data back to userspace. The vulnerability can be triggered by issuing a DM_LIST_DEVICES ioctl with a data_size of 305 bytes, leading to a slab-out-of-bounds read detected by KASAN. The issue was fixed by clamping data_start to the actual buffer size. Importantly, this out-of-bounds read requires root privileges to exploit and thus is not classified as a security vulnerability.

The impact is limited to an out-of-bounds read of up to seven bytes beyond the allocated buffer in kernel memory. This can only be triggered by a user with root privileges. There is no indication of privilege escalation or arbitrary code execution. The vulnerability does not pose a risk to unprivileged users or remote attackers.

The vulnerability has been resolved by clamping the data_start pointer to the buffer size in the Linux kernel source code. Since the issue requires root privileges to trigger and has been fixed, no additional mitigation steps are necessary beyond applying the official kernel update containing this fix. Monitor vendor advisories for the availability of the patch and apply it promptly.