CVE-2026-89559libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespace index field nslot is a u32 read from the DIMM label storage area. __nd_label_validate() bounds it against the config area size, but sizeof_namespace_label() returns unsigned, so the product nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before the comparison. A crafted nslot passes the bound and is then used as the loop trip count in nd_label_data_init(), whose memset() walks off the end of the config_size buffer: an out-of-bounds write. The field is not trusted -- it comes from the medium, or from userspace via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound check is exact; conforming labels are unaffected. The check was safe when introduced by commit 4a826c83db4e ("libnvdimm: namespace indices: read and validate"): it multiplied by sizeof(struct nd_namespace_label), a size_t, so on a 64-bit build the product did not wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions") narrowed it to 32 bits when the label size became a runtime value read via sizeof_namespace_label().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 564e871aa66f548a947b23808d3140f326381f0c before b4975f2ff6c82adc24ae547f029f82530ba43cfe; from 564e871aa66f548a947b23808d3140f326381f0c before 6030597ec683d1e5b46445f888bb5c7776b5a0c4; 564e871aa66f548a947b23808d3140f326381f0c builds before 1c391696d2791f82ae462e11da9a0d96f90b240c; from 564e871aa66f548a947b23808d3140f326381f0c before 93967bfb17dab66642c57e609c99e1a91fe11278; from 564e871aa66f548a947b23808d3140f326381f0c before e057efcc9c71d90099d9ee00bed0748d0e9fd586; 564e871aa66f548a947b23808d3140f326381f0c builds before 09e649117c54b7e1c004f22eaa19efbadd9ac856; 564e871aa66f548a947b23808d3140f326381f0c builds before 69a734359639fca16a0dd73ab17a34943e76c68b; from 564e871aa66f548a947b23808d3140f326381f0c before 037770686126155eafc44501312989e2837b9659 | CNA record |
References
- https://git.kernel.org/stable/c/b4975f2ff6c82adc24ae547f029f82530ba43cfe
- https://git.kernel.org/stable/c/6030597ec683d1e5b46445f888bb5c7776b5a0c4
- https://git.kernel.org/stable/c/1c391696d2791f82ae462e11da9a0d96f90b240c
- https://git.kernel.org/stable/c/93967bfb17dab66642c57e609c99e1a91fe11278
- https://git.kernel.org/stable/c/e057efcc9c71d90099d9ee00bed0748d0e9fd586
- https://git.kernel.org/stable/c/09e649117c54b7e1c004f22eaa19efbadd9ac856
- https://git.kernel.org/stable/c/69a734359639fca16a0dd73ab17a34943e76c68b
- https://git.kernel.org/stable/c/037770686126155eafc44501312989e2837b9659
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.