High 7.1Published May 27, 2026

CVE-2026-46070md/raid5: validate payload size before accessing journal metadata

Updated under an hour ago (Oct 27, 2026, 8:50 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b4c625c67362b3940f619c1a836b4e8329106658 before c96c6f01d84b5c67db1bf1cc8591c0b7146826fc; from b4c625c67362b3940f619c1a836b4e8329106658 before ef4851d8324fd978ca1ff9ec76a275438f887743; from b4c625c67362b3940f619c1a836b4e8329106658 before 28d3ff7109c66e99dc1b7cddacb5c760849620ef; from b4c625c67362b3940f619c1a836b4e8329106658 before 33698bd1b2db9764a29df7751533d33967ff5c98; from b4c625c67362b3940f619c1a836b4e8329106658 before c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e; from b4c625c67362b3940f619c1a836b4e8329106658 before 73ce72edd113374801045924d4417199963f73a3; from b4c625c67362b3940f619c1a836b4e8329106658 before 406aa86394ead347c47428fb51b6359bdaa2257d; from b4c625c67362b3940f619c1a836b4e8329106658 before b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.10 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/c96c6f01d84b5c67db1bf1cc8591c0b7146826fc	patch
https://git.kernel.org/stable/c/ef4851d8324fd978ca1ff9ec76a275438f887743	patch
https://git.kernel.org/stable/c/28d3ff7109c66e99dc1b7cddacb5c760849620ef	patch
https://git.kernel.org/stable/c/33698bd1b2db9764a29df7751533d33967ff5c98	patch
https://git.kernel.org/stable/c/c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e	patch
https://git.kernel.org/stable/c/73ce72edd113374801045924d4417199963f73a3	patch
https://git.kernel.org/stable/c/406aa86394ead347c47428fb51b6359bdaa2257d	patch
https://git.kernel.org/stable/c/b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.