Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — dm-verity-fec: fix reading parity bytes split across blocks (take 3)
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U H N H 7.1 .0012 2.5 —
AFFECTED
Product Versions Fixed
Linux 6df90c02bae468a3a6110bafbc659884d0c4966c – —
Linux 6.13 – 6.18.42
TIMELINE
May 13 Reserved by Linux
May 28 Published (CNA: Linux)
Aug 3 ENRICHED — CVE-2026-46130 (Linux). Received CVSS 7.1 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
fec_decode_bufs() assumes that the parity bytes of the first RS codeword
it decodes are never split across parity blocks.
This assumption is false. Consider v->fec->block_size == 4096 &&
v->fec->roots == 17 && fio->nbufs == 1, for example. In that case, each
call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs <<
DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.
Considering that the parity data for each message block starts on a
block boundary, the byte alignment in the parity data will iterate
through 272*i mod 4096 until the 3 parity blocks have been consumed. On
the 16th call (i=15), the alignment will be 4080 bytes into the first
block. Only 16 bytes remain in that block, but 17 parity bytes will be
needed. The code reads out-of-bounds from the parity block buffer.
Fortunately this doesn't normally happen, since it can occur only for
certain non-default values of fec_roots *and* when the maximum number of
buffers couldn't be allocated due to low memory. For example with
block_size=4096 only the following cases are affected:
fec_roots=17: nbufs in [1, 3, 5, 15]
fec_roots=19: nbufs in [1, 229]
fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]
fec_roots=23: nbufs in [1, 89]
Regardless, fix it by refactoring how the parity blocks are read.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 13, 2026 | Reserved | Reserved by Linux |
| May 28, 2026 | Published | Published (CNA: Linux) |
| August 3, 2026 | ENRICHED | ENRICHED — CVE-2026-46130 (Linux). Received CVSS 7.1 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 6df90c02bae468a3a6110bafbc659884d0c4966c | — |
| Linux | Linux | — | 6.13 | 6.18.42 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-46130 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.