In the Linux kernel, the following vulnerability has been resolved:
dm mirror: fix integer overflow in createdirtylog()
The argument count calculation in createdirtylog() performs
*args_used = 2 + param_count before validating against argc. When a
user provides a paramcount close to UINTMAX via the device mapper
table string, this unsigned addition wraps around to a small value,
causing the subsequent argc < *args_used check to be bypassed.
The overflowed paramcount is then passed as argc to dmdirtylogcreate(), where it can cause out-of-bounds reads on the argv array.
Fix by comparing paramcount against argc - 2 before performing the addition, following the same pattern used by parsefeatures() in the same file. Since argc >= 2 is already guaranteed, the subtraction is safe.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46023.json",
"cna_assigner": "Linux"
}