CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's md/raid5 subsystem, specifically in the journal metadata recovery routines. The flaw is reachable locally by a low-privileged user and does not require any network access or victim interaction. Successful exploitation reads kernel memory beyond valid boundaries and can crash the affected system. A patched-image rebuild at the fix versions (6.6.140, 6.12.86, and the corresponding commit SHAs) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the vulnerable service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable journal recovery code path.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the condition without involving another user.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or special memory layout is required.

Blast Radius

• Reads kernel memory beyond the page boundary, potentially exposing sensitive in-kernel data such as keys or other process memory contents.
• Causes a kernel crash (system halt or reboot) by triggering an out-of-bounds access in the RAID5 journal recovery path, disrupting all workloads on the host.
• Any container or process sharing the affected host kernel is subject to service disruption from the resulting crash.