CVE-2026-89557
Received Received - Intake

Integer Overflow in Linux Kernel md-raid Superblock Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence, 1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 1938 break; 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1)) 1940 return -EINVAL; 1941 } bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for an invalid bb->bblog_shit, it is possible to make sector be overflowed by the following calculation, 1935 sector <<= sb->bblog_shift; Then in turn when call badblocks_set() at line 1939 with the invalid rdev->badblocks.shift set at line 1930, may result an overflow inside _badblocks_clear() in block/badblocks.c. Although there are many places to call badblocks APIs, the non-zero shift value is only used in super_1_load(), other places always use 0 as the shift value. Therefore it is unnecessary to do a general shift value overflow check inside badblock API, and just check here as the caller. This may avoid unnecessary check, make the badblocks API code more simple and elegant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89557
EUVD
EUVD-2026-76468

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an overflow check issue in the md (multiple device) driver. The problem occurs when loading a superblock where the bblog_shift value, an 8-bit unsigned integer from disk, is used to calculate sector and count values. If bblog_shift is invalid, left-shifting a 64-bit sector value can cause an overflow, potentially leading to undefined behavior in the badblocks API.

Detection Guidance

This vulnerability is specific to the Linux kernel's md (multiple device) driver and relates to improper handling of the bblog_shift value in superblock loading. Detection requires checking the kernel version and md driver code for the affected function super_1_load(). No direct network detection commands are applicable as this is a local kernel-level issue.

Impact Analysis

An attacker with access to a vulnerable system could exploit this flaw to cause a kernel crash, denial of service, or potentially execute arbitrary code with kernel privileges. Systems using RAID configurations with md devices may be affected if they load a maliciously crafted superblock.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. Monitor for updates addressing CVE-2026-89557. If patches are unavailable, consider disabling the md driver modules if not in use or restrict access to block device operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart