Medium 5.5Published May 27, 2026

CVE-2026-46023dm mirror: fix integer overflow in create_dirty_log()

Updated under an hour ago (Oct 27, 2026, 10:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dm mirror: fix integer overflow in create_dirty_log() The argument count calculation in create_dirty_log() performs `*args_used = 2 + param_count` before validating against argc. When a user provides a param_count close to UINT_MAX via the device mapper table string, this unsigned addition wraps around to a small value, causing the subsequent `argc < *args_used` check to be bypassed. The overflowed param_count is then passed as argc to dm_dirty_log_create(), where it can cause out-of-bounds reads on the argv array. Fix by comparing param_count against argc - 2 before performing the addition, following the same pattern used by parse_features() in the same file. Since argc >= 2 is already guaranteed, the subtraction is safe.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e5e0ae3237584ebef510366c4cb3d5cc7c22b610; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 249c831183fb806c8e3b14c7c4c1d2fb68cf37fb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ae59b3025609d5a0a39cf5b2b94e2467f6231573; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 35f6b3281efd44d19110574663bc17a610bc73b9; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 47dad9eea75d33212d3d2cea10e7ed6a1bfc0713; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 17a08791d428885d00e510864283a7b839792368; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4c788c6f921b22f9b6c3f316c4a071c05683e7de	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4; 2.6.12; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e5e0ae3237584ebef510366c4cb3d5cc7c22b610	patch
https://git.kernel.org/stable/c/249c831183fb806c8e3b14c7c4c1d2fb68cf37fb	patch
https://git.kernel.org/stable/c/ae59b3025609d5a0a39cf5b2b94e2467f6231573	patch
https://git.kernel.org/stable/c/35f6b3281efd44d19110574663bc17a610bc73b9	patch
https://git.kernel.org/stable/c/47dad9eea75d33212d3d2cea10e7ed6a1bfc0713	patch
https://git.kernel.org/stable/c/87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca	patch
https://git.kernel.org/stable/c/17a08791d428885d00e510864283a7b839792368	patch
https://git.kernel.org/stable/c/4c788c6f921b22f9b6c3f316c4a071c05683e7de	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.