CVE-2026-46130

A flaw was found in the Linux kernel's device-mapper verity forward error correction (dm-verity-fec) component. This vulnerability occurs because a function responsible for decoding parity data makes an incorrect assumption about how these data blocks are read. Under specific, non-default configurations and low memory conditions, this can lead to an out-of-bounds read, where the system attempts to access memory beyond its allocated buffer. Such an issue could potentially result in system instability or the disclosure of sensitive information.

This vulnerability is rated as Moderate because successful exploitation requires local access alongside rare, non-default Reed-Solomon parameter settings under extreme memory pressure, limiting the overall attack surface. Standard Red Hat Enterprise Linux installations do not employ the affected forward error correction configurations by default, and establishing device-mapper verity targets strictly demands administrative privileges. Consequently, unprivileged users cannot configure vulnerable devices, and typical deployments operating with standard parameters remain unaffected by this out-of-bounds memory access flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.