In the Linux kernel, the following vulnerability has been resolved:
md/raid5: validate payload size before accessing journal metadata
r5c_recovery_analyze_meta_block() and
r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a
journal metadata block using on-disk payload size fields without
validating them against the remaining space in the metadata block.
A corrupted journal contains payload sizes extending beyond the PAGE_SIZE
boundary can cause out-of-bounds reads when accessing payload fields or
computing offsets.
Add bounds validation for each payload type to ensure the full payload
fits within meta_size before processing.
| Score | Percentile |
|---|---|
| 0.13% | 2.56% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.1 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-76hh-2v3c-vm3v ↗ |
| CVE | CVE-2026-46070 ↗ |
| CWE id | Name |
|---|---|
| CWE-787 | Out-of-bounds Write |