CVE-2026-89456 - Vulnerability Details

- s390/dasd: Propagate partial completion length across ERP recovery

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Propagate partial completion length across ERP recovery

dasd_default_erp_postaction() copies the timing and device state from
the finished ERP request back to the original request but drops
proc_bytes. A request that was partially completed, an ESE read of a
not-yet-allocated track returns fewer bytes than requested, and then
recovered through the ERP chain loses its partial-completion length.
__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole
request instead of requeueing the remainder, silently returning zeroed
data for the part that was never read.

Carry proc_bytes over to the original request like the other
per-request state.

Published: 2026-09-11

Score: 7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises in the Linux kernel’s s390/dasd subsystem. When an ERP request is partially completed, the routine dasd_default_erp_postaction() copies timing and device state but drops the proc_bytes value. A subsequent ERP recovery then sees proc_bytes as zero, causing __dasd_cleanup_cqr() to treat the entire request as complete and zero‑fill the remaining. This produces silent data corruption during DASD reads.

Affected Systems

The flaw targets the s390 DASD driver in the Linux kernel. Any system running a kernel version that includes the un‑fixed code path and that loads the default s390 kernel is potentially vulnerable. The CNA data lists no specific version range, so all affected kernel releases without the fix are at risk.

Risk and Exploitability

The CVSS score of 7.0 indicates moderate to high severity, and the EPSS score is below 1%, suggesting a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires triggering ERP operations on the affected device, so widespread abuse appears unlikely. However, environments where untrusted users can perform reads on DASD devices may face silent data corruption and confidentiality impact.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< d6b8778b1b82aa3a8dbf8612080f635b834bd16b
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< ceafb262475ac6cb3a7d07b1102608be2b216b99
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 15ec03452c18e8d288e519837d21b308300d74b2
`5e6bdd37c5526ef01326df5dabb93011ee89237e`	affected	< 6fb5ba2e7e43173a3761e46f091070a8185efa14
`fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04`	affected	—
`5f7c9989f11305aaa43e0f4378f4f070022a9f2b`	affected	—
`5.4.26`	affected	< 5.5
`5.5.10`	affected	< 5.6

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,d6b8778b1b82aa3a8dbf8612080f635b834bd16b)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,ceafb262475ac6cb3a7d07b1102608be2b216b99)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,15ec03452c18e8d288e519837d21b308300d74b2)`	affected	code_commit	['*']
`[5e6bdd37c5526ef01326df5dabb93011ee89237e,6fb5ba2e7e43173a3761e46f091070a8185efa14)`	affected	code_commit	['*']
`[fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04,*]`	affected	code_commit	['*']
`[5f7c9989f11305aaa43e0f4378f4f070022a9f2b,*]`	affected	code_commit	['*']
`[5.4.26,5.5)`	affected	semver	['*']
`[5.5.10,5.6)`	affected	semver	['*']

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.6,*]`	affected	generic	['*']
`[0,5.6)`	unaffected	generic	['*']
`[6.12.109,6.13.0)`	unaffected	semver	['*']
`[6.18.50,6.19.0)`	unaffected	semver	['*']
`[7.2.4,7.3.0)`	unaffected	semver	['*']
`[7.3-rc1,*]`	unaffected	generic	['*']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix for the missing proc_bytes propagation in the s390 DASD driver.
Restrict access to DASD devices so that only privileged processes can issue ERP operations.
Implement integrity checks (e.g., checksums or cryptographic hashes) on data read.

Generated by OpenCVE AI on September 13, 2026 at 08:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2
https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14
https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99
https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b
https://nvd.nist.gov/vuln/detail/CVE-2026-89456
https://www.cve.org/CVERecord?id=CVE-2026-89456

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89456 https://www.cve.org/CVERecord?id=CVE-2026-89456
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
Title		s390/dasd: Propagate partial completion length across ERP recovery
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2 https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14 https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99 https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:20.037Z

Updated: 2026-09-13T06:29:32.532Z

Reserved: 2026-09-11T19:38:34.707Z

Link: CVE-2026-89456

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:26.387

Modified: 2026-09-13T07:17:09.600

Link: CVE-2026-89456

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:20Z

Links: CVE-2026-89456 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T03:45:18Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object