CVE-2026-89559

Received Received - Intake

Integer Overflow in Linux Kernel libnvdimm Labels

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespace index field nslot is a u32 read from the DIMM label storage area. __nd_label_validate() bounds it against the config area size, but sizeof_namespace_label() returns unsigned, so the product nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before the comparison. A crafted nslot passes the bound and is then used as the loop trip count in nd_label_data_init(), whose memset() walks off the end of the config_size buffer: an out-of-bounds write. The field is not trusted -- it comes from the medium, or from userspace via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound check is exact; conforming labels are unaffected. The check was safe when introduced by commit 4a826c83db4e ("libnvdimm: namespace indices: read and validate"): it multiplied by sizeof(struct nd_namespace_label), a size_t, so on a 64-bit build the product did not wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions") narrowed it to 32 bits when the label size became a runtime value read via sizeof_namespace_label().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89559

EUVD

EUVD-2026-76470

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an integer overflow in the libnvdimm labels subsystem. The issue occurs when validating the namespace index field 'nslot' from DIMM label storage. The product of 'nslot' and 'label_size' is calculated in 32-bit arithmetic, causing it to wrap around before a bounds check. This allows a crafted value to bypass validation and trigger an out-of-bounds write in nd_label_data_init() via a loop in memset().

Detection Guidance

This vulnerability is specific to the Linux kernel's libnvdimm subsystem and requires kernel-level access to detect. There are no direct network commands to detect it. Check kernel logs for out-of-bounds write errors or monitor for crashes in nd_label_data_init() or __nd_label_validate(). Use 'dmesg | grep libnvdimm' or 'journalctl -k | grep libnvdimm' to inspect kernel logs for related errors.

Impact Analysis

This vulnerability could allow an attacker with access to the system or control over ND_CMD_SET_CONFIG_DATA to execute arbitrary code or cause a denial of service by triggering memory corruption. It may lead to system crashes, data corruption, or privilege escalation if exploited.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch the integer overflow in libnvdimm/labels. If immediate patching is not possible, restrict access to ND_CMD_SET_CONFIG_DATA ioctl operations and validate namespace labels manually before processing. Monitor vendor advisories for kernel updates addressing CVE-2026-89559.

Hi! I’m here to help you understand CVE-2026-89559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70