CVE-2026-46070

A flaw was found in the Linux kernel's md/raid5 component. This vulnerability arises from insufficient validation of payload sizes within journal metadata blocks. A local attacker can exploit this by providing a corrupted journal, leading to out-of-bounds reads when the system processes payload fields or computes offsets. This could result in information disclosure or system instability.

md raid5 r5cache recovery parses journal metadata payloads using size fields stored on disk. A corrupted or crafted journal can make a payload extend beyond the metadata block and cause out of bounds reads in r5c_recovery_analyze_meta_block() or r5l_recovery_verify_data_checksum_for_mb(). For the CVSS the PR:H is selected because reliable triggering normally requires administrative or block device level control over md raid journal metadata, or control of the underlying storage. The issue is not directly network reachable and is triggered during local RAID recovery or journal verification. Impact is at least denial of service via kernel crash or failed recovery. In the paranoid view, limited confidentiality or integrity impact is kept possible because this is an OOB read in kernel recovery code, but no controlled write or strong privilege escalation primitive is shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.