CVE-2026-89573dm array: reject an array block whose value size is not the caller's
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 builds before 35cd3b278448c79614f65ab6bbc9ed348d847df9; from 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 before a8237cb8fa0a628d903e76635bfdeae4202036b9; from 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 before a530a9a419a7c5fdb7dae55ffa2dd7a130631842; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 builds before 522fa26da24ccaa298ebe3c1c97395d2d63dfc21; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 builds before 7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c; from 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 before ac4a5eb8b002a0742c938fc98b922e243f53573a; from 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 before cb409b38b0232ee4385ef55cddcd6fbdd011a8a2; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 builds before 4538a287bdf5d0f9a379c678e5262b9f5783f547 | CNA record |
References
- https://git.kernel.org/stable/c/35cd3b278448c79614f65ab6bbc9ed348d847df9
- https://git.kernel.org/stable/c/a8237cb8fa0a628d903e76635bfdeae4202036b9
- https://git.kernel.org/stable/c/a530a9a419a7c5fdb7dae55ffa2dd7a130631842
- https://git.kernel.org/stable/c/522fa26da24ccaa298ebe3c1c97395d2d63dfc21
- https://git.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c
- https://git.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573a
- https://git.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2
- https://git.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.