CVE-2026-89574

Received Received - Intake

dm-array Block Header Validation Flaw in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and csum and nothing else, while node_check(), next to it, has bounded the structural fields since both were written. dm_array_cursor_next() takes its loop bound from the on-disk nr_entries and element_at() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dm_cache_load_mappings() drives it once per cache block at activation. Check the header against itself: reject a zero value_size, require max_entries to equal calc_max_entries() for that value_size and block size, and require nr_entries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUG_ON() in fill_ablock() and trim_ablock(). Metadata dm-array writes satisfies all three.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89574

EUVD

EUVD-2026-76486

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of array block headers during read operations in the device-mapper (dm) array subsystem. The issue occurs because array_block_check() only validates blocknr and checksum but not structural fields like value_size, max_entries, or nr_entries. This can lead to out-of-bounds reads when the cursor index exceeds the block's capacity, causing the read operation to walk off the dm-bufio buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's device-mapper (dm) array implementation. Detection requires checking kernel logs for errors related to dm-bufio buffer overflows or invalid array block headers. Use commands like dmesg | grep dm-array or journalctl -k | grep dm-array to inspect kernel logs for suspicious activity.

Impact Analysis

An attacker with local access could exploit this flaw to trigger memory corruption or denial-of-service conditions by crafting malicious metadata. This may lead to system crashes, data corruption, or unauthorized access depending on the kernel's behavior after the out-of-bounds read occurs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel memory corruption issue in the device-mapper array implementation. There is no evidence it involves data exposure, unauthorized access, or privacy violations that would trigger regulatory non-compliance.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling affected device-mapper array features until patched. Monitor kernel logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-89574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70