In the Linux kernel, the following vulnerability has been resolved:

dm era: fix out-of-bounds memory access for non-zero start sector

dm-era tracks writes in target-relative blocks, but era_map() calculates
the writeset block before applying the target offset.  Tables with a
non-zero start sector can therefore pass an absolute mapped-device block
to metadata_current_marked().

If the absolute block is beyond the current writeset size,
writeset_marked() tests past the end of the in-core bitset.  KASAN reports
this as a vmalloc-out-of-bounds access.

Apply the target offset before calculating the era block so writeset
lookups use the target-relative block number.

https://git.kernel.org/stable/c/1fcb5e29dd7a5b85adb9d8b539911741d878e829

https://git.kernel.org/stable/c/7e1822f83c5a1ee7b4a19e98edde8770a10b4c71

https://git.kernel.org/stable/c/9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f

https://git.kernel.org/stable/c/a868196f03c2b19418ae3d2b69e195d668a271e5

https://git.kernel.org/stable/c/bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6

https://git.kernel.org/stable/c/db5f9b4601f0012038e5a2628aedec2f47933380

https://git.kernel.org/stable/c/e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5

https://git.kernel.org/stable/c/fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/md/dm-era-target.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"fe94a0b14010a3c267ff9a2508afb4f27ff1c5bf","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"e3ffa8e492e5cdee62d916ee3e9244ccce2b73c5","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"9946a7176bd8c25ddd6e5f1799c54e572ee6bf0f","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"7e1822f83c5a1ee7b4a19e98edde8770a10b4c71","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"db5f9b4601f0012038e5a2628aedec2f47933380","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"1fcb5e29dd7a5b85adb9d8b539911741d878e829","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"bafe3e720cdac38cd7ea4eb7852a8f2dbe1bbfe6","versionType":"git","status":"affected"},{"version":"eec40579d84873dfb7021eb24c50360f073237c5","lessThan":"a868196f03c2b19418ae3d2b69e195d668a271e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/md/dm-era-target.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]