GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89574 (GCVE-0-2026-89574)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31
VLAI
Title
dm array: validate array block headers on read
Summary
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and csum and nothing else, while node_check(), next to it, has bounded the structural fields since both were written. dm_array_cursor_next() takes its loop bound from the on-disk nr_entries and element_at() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dm_cache_load_mappings() drives it once per cache block at activation. Check the header against itself: reject a zero value_size, require max_entries to equal calc_max_entries() for that value_size and block size, and require nr_entries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUG_ON() in fill_ablock() and trim_ablock(). Metadata dm-array writes satisfies all three.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 , < 67adda7ed5da3e3b64f5b9021a02c21fb374fd9c (git)
Affected: 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 , < b33f76d33aaeacf3baf3370d8d64985169b36600 (git)
Affected: 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 , < 9808ddffb4bc659352df3020cd84d9d864820ee5 (git)
Affected: 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 , < 2965787723084835b18dfe993cd450ebf5bd4540 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67adda7ed5da3e3b64f5b9021a02c21fb374fd9c",
              "status": "affected",
              "version": "6513c29f44f2cc970c0e9fecfe5a6526c3e73025",
              "versionType": "git"
            },
            {
              "lessThan": "b33f76d33aaeacf3baf3370d8d64985169b36600",
              "status": "affected",
              "version": "6513c29f44f2cc970c0e9fecfe5a6526c3e73025",
              "versionType": "git"
            },
            {
              "lessThan": "9808ddffb4bc659352df3020cd84d9d864820ee5",
              "status": "affected",
              "version": "6513c29f44f2cc970c0e9fecfe5a6526c3e73025",
              "versionType": "git"
            },
            {
              "lessThan": "2965787723084835b18dfe993cd450ebf5bd4540",
              "status": "affected",
              "version": "6513c29f44f2cc970c0e9fecfe5a6526c3e73025",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/persistent-data/dm-array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: validate array block headers on read\n\narray_block_check() validates blocknr and csum and nothing else, while\nnode_check(), next to it, has bounded the structural fields since both\nwere written. dm_array_cursor_next() takes its loop bound from the\non-disk nr_entries and element_at() is unguarded pointer arithmetic, so\na count larger than the block holds keeps the cursor in one block while\nthe index grows past it and the read walks off the dm-bufio buffer --\ndm_cache_load_mappings() drives it once per cache block at activation.\n\nCheck the header against itself: reject a zero value_size, require\nmax_entries to equal calc_max_entries() for that value_size and block\nsize, and require nr_entries to fit. Equality rather than an upper bound,\nsince a count below the real capacity trips BUG_ON() in fill_ablock() and\ntrim_ablock(). Metadata dm-array writes satisfies all three."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when the kernel reads attacker-crafted dm-array metadata from a local block device during device-mapper activation (dm-cache dm_cache_load_mappings, dm-clone bitset load, or dm-era array resize), not via a network protocol.\nAC:L - The attacker fully controls the on-disk array-block header (nr_entries, max_entries, value_size) and can compute a matching checksum, so activation deterministically walks off the dm-bufio buffer; there is no race or attacker-uncontrollable memory layout.\nPR:L - Device-mapper ioctls require init-namespace CAP_SYS_ADMIN and are not reachable via user namespaces, but the malformed data is on-disk metadata, so the attacker only needs write access to the backing store (loop file, VM/container disk, iSCSI/NBD LUN) that a dm-cache/dm-era/dm-clone stack is built on.\nUI:N - Once corrupt metadata is on the backing store, LVM/udev autoactivation, boot, or reattachment of the volume loads mappings without a separate victim action such as mounting a filesystem or opening a file.\nS:U - The out-of-bounds access is confined to kernel dm-bufio metadata buffers on the same host; this is ordinary kernel memory corruption, not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - dm_array_cursor_next() takes its loop bound from on-disk nr_entries while element_at() is unguarded pointer arithmetic, so a too-large count keeps the cursor in one block and reads past the dm-bufio data buffer (typically a 4K slab/page) for every cache block at activation, an unbounded kernel out-of-bounds read.\nI:H - Unchecked headers let fill_ablock()/trim_ablock() hit BUG_ON on resize, and out-of-bounds mapping, hint, and bitset values from adjacent kernel memory are installed into the cache policy and then used for origin/cache I/O, giving a memory-corruption integrity primitive.\nA:H - Walking off the dm-bufio buffer causes a kernel oops or KASAN panic, and an undersized on-disk max_entries hits BUG_ON in fill_ablock() and trim_ablock() during array resize at activation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:11.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600"
        },
        {
          "url": "https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540"
        }
      ],
      "title": "dm array: validate array block headers on read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89574",
    "datePublished": "2026-09-11T19:44:42.494Z",
    "dateReserved": "2026-09-11T19:38:34.727Z",
    "dateUpdated": "2026-09-13T06:31:11.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89574",
      "date": "2026-09-15",
      "epss": "0.00163",
      "percentile": "0.05875"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89574\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:41.517\",\"lastModified\":\"2026-09-13T07:17:23.347\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm array: validate array block headers on read\\n\\narray_block_check() validates blocknr and csum and nothing else, while\\nnode_check(), next to it, has bounded the structural fields since both\\nwere written. dm_array_cursor_next() takes its loop bound from the\\non-disk nr_entries and element_at() is unguarded pointer arithmetic, so\\na count larger than the block holds keeps the cursor in one block while\\nthe index grows past it and the read walks off the dm-bufio buffer --\\ndm_cache_load_mappings() drives it once per cache block at activation.\\n\\nCheck the header against itself: reject a zero value_size, require\\nmax_entries to equal calc_max_entries() for that value_size and block\\nsize, and require nr_entries to fit. Equality rather than an upper bound,\\nsince a count below the real capacity trips BUG_ON() in fill_ablock() and\\ntrim_ablock(). Metadata dm-array writes satisfies all three.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/persistent-data/dm-array.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\"lessThan\":\"67adda7ed5da3e3b64f5b9021a02c21fb374fd9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\"lessThan\":\"b33f76d33aaeacf3baf3370d8d64985169b36600\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\"lessThan\":\"9808ddffb4bc659352df3020cd84d9d864820ee5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\"lessThan\":\"2965787723084835b18dfe993cd450ebf5bd4540\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/persistent-data/dm-array.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:58:11+00:00",
      "cve": "CVE-2026-89574",
      "id": "CVE-2026-89574",
      "initial_release_date": "2026-09-11T19:44:42.494000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: dm array out-of-bounds read due to insufficient header validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89574.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T00:58:21Z",
      "cve": "CVE-2026-89574",
      "id": "CVE-2026-89574",
      "initial_release_date": "2026-09-15T00:58:21Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89574",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89574.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.