---
id: "CVE-2026-99063"
kind: "vulnerability"
aliases: ["CVE-2026-99063"]
title: "Linux kernel: device-mapper ioctl over-reads a buffer, leaking adjacent kernel memory"
severity: "low"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["device-mapper", "kernel", "linux", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-untrusted-root"]
published_at: "2026-10-23T13:17:30+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99063", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99063", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: device-mapper ioctl over-reads a buffer, leaking adjacent kernel memory

The device-mapper ioctl handler sets its data offset past a small caller-supplied buffer, so copying the result back to userspace reads seven bytes beyond the allocation. The sources say only root can trigger it, and that the leaked bytes are whatever sat next to the allocation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99063
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99063

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: don't let data_start run past the buffer

struct dm_ioctl has seven bytes of trailing padding, so the smallest
buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),
is seven bytes shorter than sizeof(struct dm_ioctl).

get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without
looking at how big the buffer actually is. Ask for the minimum and
data_start ends up seven bytes past the end. Callers add it to
data_size, and ctl_ioctl() copies that much back to userspace:

  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0
  Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140
   ctl_ioctl+0x5e3/0xcb0
   dm_ctl_ioctl+0x25/0x40
  allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)

A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the
seven bytes that leak are whatever sat next to the allocation.

Clamp data_start to the buffer size.

Note that this is not a security bug because the out-of-bounds read can
only be triggered by root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_