---
id: CVE-2026-46130
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-verity-fec: fix reading parity bytes split across blocks (take 3)

  fec_decode_bufs() assumes that the parity bytes of the first RS codeword
  it decodes are never spli…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm-verity-fec: fix reading parity bytes split across blocks (take 3)

  fec_decode_bufs() assumes that the parity bytes of the first RS codeword
  it decodes are never spli…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.1.125, < 6.2'
  - 'linux_kernel >= 6.6.72, < 6.7'
  - 'linux_kernel >= 6.12.10, < 6.13'
  - 'linux_kernel >= 6.13.1, < 7.0.7'
  - linux_kernel = 6.13
patched:
  - linux_kernel 7.0.7
published: '2026-05-28'
updated: '2026-08-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46130'
references:
  - url: 'https://git.kernel.org/stable/c/3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d47281b9a4472cfd73122393e79fbe76b651e46a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00164
epssPercentile: 0.04933
ingestedAt: '2026-08-03T10:24:20.003Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm-verity-fec: fix reading parity bytes split across blocks (take 3)

fec_decode_bufs() assumes that the parity bytes of the first RS codeword
it decodes are never split across parity blocks.

This assumption is false.  Consider v->fec->block_size == 4096 &&
v->fec->roots == 17 && fio->nbufs == 1, for example.  In that case, each
call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs <<
DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.

Considering that the parity data for each message block starts on a
block boundary, the byte alignment in the parity data will iterate
through 272*i mod 4096 until the 3 parity blocks have been consumed.  On
the 16th call (i=15), the alignment will be 4080 bytes into the first
block.  Only 16 bytes remain in that block, but 17 parity bytes will be
needed.  The code reads out-of-bounds from the parity block buffer.

Fortunately this doesn't normally happen, since it can occur only for
certain non-default values of fec_roots *and* when the maximum number of
buffers couldn't be allocated due to low memory.  For example with
block_size=4096 only the following cases are affected:

    fec_roots=17: nbufs in [1, 3, 5, 15]
    fec_roots=19: nbufs in [1, 229]
    fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]
    fec_roots=23: nbufs in [1, 89]

Regardless, fix it by refactoring how the parity blocks are read.

## Affected

- `linux_kernel >= 6.1.125, < 6.2`
- `linux_kernel >= 6.6.72, < 6.7`
- `linux_kernel >= 6.12.10, < 6.13`
- `linux_kernel >= 6.13.1, < 7.0.7`
- `linux_kernel = 6.13`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.7`