---
cve: "CVE-2026-89574"
severity: "HIGH"
cvss: 7.8
epss: "16%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 20:19:41"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T04:17:39+02:00"
---

# CVE-2026-89574

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

dm array: validate array block headers on read

array_block_check() validates blocknr and csum and nothing else, while
node_check(), next to it, has bounded the structural fields since both
were written. dm_array_cursor_next() takes its loop bound from the
on-disk nr_entries and element_at() is unguarded pointer arithmetic, so
a count larger than the block holds keeps the cursor in one block while
the index grows past it and the read walks off the dm-bufio buffer --
dm_cache_load_mappings() drives it once per cache block at activation.

Check the header against itself: reject a zero value_size, require
max_entries to equal calc_max_entries() for that value_size and block
size, and require nr_entries to fit. Equality rather than an upper bound,
since a count below the real capacity trips BUG_ON() in fill_ablock() and
trim_ablock(). Metadata dm-array writes satisfies all three.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.12.109
- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## Referenzen

- <https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c>
- <https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600>
- <https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5>
- <https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89574) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_