CVE-2026-89573

Received Received - Intake

dm array block value size mismatch in Linux kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89573

EUVD

EUVD-2026-76485

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the device-mapper (dm) array handling. The issue occurs when an array block's value size does not match the caller's expected size, leading to potential memory corruption or incorrect data access. Specifically, dm-cache uses two arrays with different value sizes, and a mismatch can cause incorrect pointer arithmetic, resulting in out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's device-mapper (dm) array implementation and requires examining kernel metadata. Detection involves checking for crafted metadata blocks where value sizes mismatch. Use kernel logs for errors related to dm-cache or array_block_check(). Commands like dmesg | grep dm-cache or journalctl -k | grep dm-array may help identify issues.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to craft malicious metadata, triggering memory corruption or crashes in the kernel. This might lead to denial-of-service conditions or privilege escalation, depending on the system configuration and kernel version.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Avoid using untrusted or modified device-mapper metadata. If using dm-cache, verify metadata integrity before applying changes. Monitor kernel logs for dm-related errors.

Hi! I’m here to help you understand CVE-2026-89573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70