CVE-2026-89456 - Vulnerability Details

- s390/dasd: Propagate partial completion length across ERP recovery

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Propagate partial completion length across ERP recovery

dasd_default_erp_postaction() copies the timing and device state from
the finished ERP request back to the original request but drops
proc_bytes. A request that was partially completed, an ESE read of a
not-yet-allocated track returns fewer bytes than requested, and then
recovered through the ERP chain loses its partial-completion length.
__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole
request instead of requeueing the remainder, silently returning zeroed
data for the part that was never read.

Carry proc_bytes over to the original request like the other
per-request state.

Published: 2026-09-11

Score: 7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel s390/dasd subsystem contains a flaw where a partially completed ERP request inadvertently loses its proc_bytes value during recovery. When the cleanup routine later interprets this zero value, it mistakenly treats the entire request as complete and zero‑fills any remaining unread data. The result is silent corruption of data read from DASD devices, compromising data integrity without triggering error codes or crashes.

Affected Systems

The vulnerability affects the s390 DASD driver within the Linux kernel. Any system running a kernel version that contains the unpatched code path and that relies on the default s390 kernel is potentially at risk. No specific version range is listed, so all affected releases lacking the fix should be considered vulnerable.

Risk and Exploitability

The CVSS score of 7.0 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger ERP operations on a DASD device, so widespread abuse remains limited. However, environments that allow untrusted users to issue reads on DASD devices face potential silent data corruption and loss of confidentiality or integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 9e063165d3fe58db2a517717b830f17e82d03467
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 6b0954c8a259da1e4aa745989f82723947acfb46
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< f735b9710f0c8fe72c1060103e865f4ae678190b
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< d6b8778b1b82aa3a8dbf8612080f635b834bd16b
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< ceafb262475ac6cb3a7d07b1102608be2b216b99
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 15ec03452c18e8d288e519837d21b308300d74b2
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 6fb5ba2e7e43173a3761e46f091070a8185efa14
`fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04`	affected	—
`5f7c9989f11305aaa43e0f4378f4f070022a9f2b`	affected	—
`5.4.26`	affected	< 5.5
`5.5.10`	affected	< 5.6

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,d6b8778b1b82aa3a8dbf8612080f635b834bd16b)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,ceafb262475ac6cb3a7d07b1102608be2b216b99)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,15ec03452c18e8d288e519837d21b308300d74b2)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,6fb5ba2e7e43173a3761e46f091070a8185efa14)`	affected	code_commit	['*']
`[fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04,*]`	affected	code_commit	['*']
`[5f7c9989f11305aaa43e0f4378f4f070022a9f2b,*]`	affected	code_commit	['*']
`[5.4.26,5.5)`	affected	semver	['*']
`[5.5.10,5.6)`	affected	semver	['*']

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.6,*]`	affected	generic	['*']
`[0,5.6)`	unaffected	generic	['*']
`[6.12.109,6.13.0)`	unaffected	semver	['*']
`[6.18.50,6.19.0)`	unaffected	semver	['*']
`[7.2.4,7.3.0)`	unaffected	semver	['*']
`[7.3-rc1,*]`	unaffected	generic	['*']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the fix for the missing proc_bytes propagation in the s390 DASD driver.
Limit access to DASD devices so that only privileged, trusted processes can perform ERP operations.
Implement data integrity checks (e.g., checksums or cryptographic hashes) on data read from DASD to detect silent corruption.

Generated by OpenCVE AI on September 21, 2026 at 01:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2
https://git.kernel.org/stable/c/6b0954c8a259da1e4aa745989f82723947acfb46
https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14
https://git.kernel.org/stable/c/9e063165d3fe58db2a517717b830f17e82d03467
https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99
https://git.kernel.org/stable/c/d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f
https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b
https://git.kernel.org/stable/c/f735b9710f0c8fe72c1060103e865f4ae678190b
https://nvd.nist.gov/vuln/detail/CVE-2026-89456
https://www.cve.org/CVERecord?id=CVE-2026-89456

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6b0954c8a259da1e4aa745989f82723947acfb46 https://git.kernel.org/stable/c/9e063165d3fe58db2a517717b830f17e82d03467 https://git.kernel.org/stable/c/d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f https://git.kernel.org/stable/c/f735b9710f0c8fe72c1060103e865f4ae678190b

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89456 https://www.cve.org/CVERecord?id=CVE-2026-89456
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
Title		s390/dasd: Propagate partial completion length across ERP recovery
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2 https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14 https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99 https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:20.037Z

Updated: 2026-09-14T11:59:56.742Z

Reserved: 2026-09-11T19:38:34.707Z

Link: CVE-2026-89456

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:26.387

Modified: 2026-09-14T13:19:01.933

Link: CVE-2026-89456

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:20Z

Links: CVE-2026-89456 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:15:03Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object