{"id":"CVE-2026-89574","title":"dm array: validate array block headers on read","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: validate array block headers on read\n\narray_block_check() validates blocknr and csum and nothing else, while\nnode_check(), next to it, has bounded the structu…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 0e3b8f371c385c212b6e6f76c66f5b3f5bcfea62","Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 67adda7ed5da3e3b64f5b9021a02c21fb374fd9c","Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < b33f76d33aaeacf3baf3370d8d64985169b36600","Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 9808ddffb4bc659352df3020cd84d9d864820ee5","Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 2965787723084835b18dfe993cd450ebf5bd4540","Linux 3.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:24:26.489606Z"},"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:47:56.785Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89574","references":[{"url":"https://git.kernel.org/stable/c/0e3b8f371c385c212b6e6f76c66f5b3f5bcfea62"},{"url":"https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c"},{"url":"https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600"},{"url":"https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5"},{"url":"https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89574.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89574"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532117"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89574"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89574"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89574.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00168,"epssPercentile":0.06171,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.474Z","slug":"CVE-2026-89574","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndm array: validate array block headers on read\n\narray_block_check() validates blocknr and csum and nothing else, while\nnode_check(), next to it, has bounded the structural fields since both\nwere written. dm_array_cursor_next() takes its loop bound from the\non-disk nr_entries and element_at() is unguarded pointer arithmetic, so\na count larger than the block holds keeps the cursor in one block while\nthe index grows past it and the read walks off the dm-bufio buffer --\ndm_cache_load_mappings() drives it once per cache block at activation.\n\nCheck the header against itself: reject a zero value_size, require\nmax_entries to equal calc_max_entries() for that value_size and block\nsize, and require nr_entries to fit. Equality rather than an upper bound,\nsince a count below the real capacity trips BUG_ON() in fill_ablock() and\ntrim_ablock(). Metadata dm-array writes satisfies all three.\n\n## Affected\n\n- `Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 0e3b8f371c385c212b6e6f76c66f5b3f5bcfea62`\n- `Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 67adda7ed5da3e3b64f5b9021a02c21fb374fd9c`\n- `Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < b33f76d33aaeacf3baf3370d8d64985169b36600`\n- `Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 9808ddffb4bc659352df3020cd84d9d864820ee5`\n- `Linux >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 < 2965787723084835b18dfe993cd450ebf5bd4540`\n- `Linux 3.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89574.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223275,"id":"CVE-2026-89574","ts":1792180038479,"field":"cvss","old":"5.5","new":"7.8"},{"seq":223274,"id":"CVE-2026-89574","ts":1792180038479,"field":"severity","old":"medium","new":"high"},{"seq":208096,"id":"CVE-2026-89574","ts":1789922708105,"field":"cvss","old":"5.1","new":"5.5"},{"seq":202875,"id":"CVE-2026-89574","ts":1789403732765,"field":"cvss","old":"7.8","new":"5.1"},{"seq":202874,"id":"CVE-2026-89574","ts":1789403732765,"field":"severity","old":"high","new":"medium"},{"seq":197904,"id":"CVE-2026-89574","ts":1789384320886,"field":"cvss","old":"5.1","new":"7.8"},{"seq":197903,"id":"CVE-2026-89574","ts":1789384320886,"field":"severity","old":"medium","new":"high"},{"seq":183449,"id":"CVE-2026-89574","ts":1789356675413,"field":"cvss","old":"7.8","new":"5.1"},{"seq":183448,"id":"CVE-2026-89574","ts":1789356675413,"field":"severity","old":"high","new":"medium"},{"seq":153390,"id":"CVE-2026-89574","ts":1789285350321,"field":"cvss","old":null,"new":"7.8"},{"seq":153389,"id":"CVE-2026-89574","ts":1789285350321,"field":"severity","old":"none","new":"high"},{"seq":147704,"id":"CVE-2026-89574","ts":1789270211950,"field":"cvss","old":null,"new":"5.1"},{"seq":147703,"id":"CVE-2026-89574","ts":1789270211950,"field":"severity","old":"none","new":"medium"},{"seq":109458,"id":"CVE-2026-89574","ts":1789183731992,"field":"cvss","old":null,"new":"5.1"},{"seq":109457,"id":"CVE-2026-89574","ts":1789183731992,"field":"severity","old":"none","new":"medium"}]}