CVE-2026-89965nvdimm/btt: reject an arena whose nfree is below the lane count
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree. A crafted or foreign arena whose nfree is below the lane count makes freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write. btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the code does not currently honor: num_lanes is ND_MAX_LANES regardless of nfree. Reject an arena whose nfree is below num_lanes at discovery, before the per-lane arrays are allocated, enforcing that invariant.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5212e11fde4d40fa627668b4f2222d20db488f71 before eb491343d2d1784121ad9af91c25b338c28913c3; 5212e11fde4d40fa627668b4f2222d20db488f71 builds before 59d5cd1f42b4bab3609512c3cb3d3540d3d21da7; from 5212e11fde4d40fa627668b4f2222d20db488f71 before f6c5313aae794ecca8f762c1a3493de5c266f120; from 5212e11fde4d40fa627668b4f2222d20db488f71 before f9bf05c63b77d000e9c01f3e47af36973887d350; 5212e11fde4d40fa627668b4f2222d20db488f71 builds before 6f79d1a5f2611a3d36e9312be5425cd9cb397c51; 5212e11fde4d40fa627668b4f2222d20db488f71 builds before 6b1faf1f099f7060b5f1f2f0d024132581f1726e; 5212e11fde4d40fa627668b4f2222d20db488f71 builds before 9dfa11cef4750b67591307f2c62e47a23d60e4b7; 5212e11fde4d40fa627668b4f2222d20db488f71 builds before 6a1f2e5ed9267ca19187038ac635393c165213ac | CNA record |
References
- https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3
- https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7
- https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120
- https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350
- https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51
- https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e
- https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7
- https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.