CVE-2026-46294: dm: fix a buffer overflow in ioctl processing

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dm: fix a buffer overflow in ioctl processing

Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the
function retrieve_status:

1. The code in retrieve_status checks that the output string fits into
   the output buffer and writes the output string there
2. Then, the code aligns the "outptr" variable to the next 8-byte
   boundary:
	outptr = align_ptr(outptr);
3. The alignment doesn't check overflow, so outptr could point past the
   buffer end
4. The "for" loop is iterated again, it executes:
	remaining = len - (outptr - outbuf);
5. If "outptr" points past "outbuf + len", the arithmetics wraps around
   and the variable "remaining" contains unusually high number
6. With "remaining" being high, the code writes more data past the end of
   the buffer

Luckily, this bug has no security implications because:
1. Only root can issue device mapper ioctls
2. The commonly used libraries that communicate with device mapper
   (libdevmapper and devicemapper-rs) use buffer size that is aligned to
   8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input
   buffer and the bug can't happen accidentally

The Linux kernel CVE team has assigned CVE-2026-46294 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.258 with commit c8c5311237448f6ffeecc9aec2362e3692623668
	Fixed in 5.15.209 with commit 448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
	Fixed in 6.1.175 with commit 526ff9126a0ae087b65726e1faf31114c718020d
	Fixed in 6.6.140 with commit f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a
	Fixed in 6.12.88 with commit d271631023cbe1cbe7c31a0275ab797883be6e0a
	Fixed in 6.18.30 with commit 5af6a879e915ae7bcd83695c316ebb32e1c61bc2
	Fixed in 7.0.7 with commit 8daa6c708ef524089ae43f2aed9190acb26d7df8
	Fixed in 7.1-rc1 with commit 2fa49cc884f6496a915c35621ba4da35649bf159

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-46294
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/dm-ioctl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668
	https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c
	https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d
	https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a
	https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a
	https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2
	https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8
	https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159