CVE-2026-89574 - Vulnerability Details

- dm array: validate array block headers on read

Description

In the Linux kernel, the following vulnerability has been resolved:

dm array: validate array block headers on read

array_block_check() validates blocknr and csum and nothing else, while
node_check(), next to it, has bounded the structural fields since both
were written. dm_array_cursor_next() takes its loop bound from the
on-disk nr_entries and element_at() is unguarded pointer arithmetic, so
a count larger than the block holds keeps the cursor in one block while
the index grows past it and the read walks off the dm-bufio buffer --
dm_cache_load_mappings() drives it once per cache block at activation.

Check the header against itself: reject a zero value_size, require
max_entries to equal calc_max_entries() for that value_size and block
size, and require nr_entries to fit. Equality rather than an upper bound,
since a count below the real capacity trips BUG_ON() in fill_ablock() and
trim_ablock(). Metadata dm-array writes satisfies all three.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises in the Linux device‑mapper array header validation, where array_block_check() verifies only blocknr and checksum, leaving structural fields‑bounds read during dm_array_cursor_next() when the on‑disk entry count exceeds a block’s capacity, potentially exposing kernel memory or triggering a fault that could result in information disclosure or crash.

Affected Systems

Linux kernels that include the dm-array module are affected. This includes any distribution that uses the device‑mapper array feature and any kernel revision prior to the applied fix.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS indicates a very low likelihood of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. The CVE entry does not specify the attack vector or required privileges, so the exact scope and ease of exploitation cannot be determined from the data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6513c29f44f2cc970c0e9fecfe5a6526c3e73025`	affected	< 67adda7ed5da3e3b64f5b9021a02c21fb374fd9c
`6513c29f44f2cc970c0e9fecfe5a6526c3e73025`	affected	< b33f76d33aaeacf3baf3370d8d64985169b36600
`6513c29f44f2cc970c0e9fecfe5a6526c3e73025`	affected	< 9808ddffb4bc659352df3020cd84d9d864820ee5
`6513c29f44f2cc970c0e9fecfe5a6526c3e73025`	affected	< 2965787723084835b18dfe993cd450ebf5bd4540

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply dm-array block header validation, restoring correct bounds checking.
Unload or blacklist the dm-array module to prevent execution of vulnerable code until the update is applied.
If maintaining an older kernel where no update is available, manually apply the patch from the linked commit that adds proper header validation or disable the dm-array feature in the kernel configuration.

Generated by OpenCVE AI on September 13, 2026 at 04:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540
https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c
https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5
https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600
https://nvd.nist.gov/vuln/detail/CVE-2026-89574
https://www.cve.org/CVERecord?id=CVE-2026-89574

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89574 https://www.cve.org/CVERecord?id=CVE-2026-89574
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and csum and nothing else, while node_check(), next to it, has bounded the structural fields since both were written. dm_array_cursor_next() takes its loop bound from the on-disk nr_entries and element_at() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dm_cache_load_mappings() drives it once per cache block at activation. Check the header against itself: reject a zero value_size, require max_entries to equal calc_max_entries() for that value_size and block size, and require nr_entries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUG_ON() in fill_ablock() and trim_ablock(). Metadata dm-array writes satisfies all three.
Title		dm array: validate array block headers on read
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540 https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5 https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:42.494Z

Updated: 2026-09-13T06:31:11.485Z

Reserved: 2026-09-11T19:38:34.727Z

Link: CVE-2026-89574

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:41.517

Modified: 2026-09-13T07:17:23.347

Link: CVE-2026-89574

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:42Z

Links: CVE-2026-89574 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T05:00:12Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object