dm array: reject an array block whose value size is not the caller's

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89573
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:41 UTC
Updated2026-09-11 20:19:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c git Not specified
CNA Linux Linux affected 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 ac4a5eb8b002a0742c938fc98b922e243f53573a git Not specified
CNA Linux Linux affected 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 cb409b38b0232ee4385ef55cddcd6fbdd011a8a2 git Not specified
CNA Linux Linux affected 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 4538a287bdf5d0f9a379c678e5262b9f5783f547 git Not specified
CNA Linux Linux affected 3.9 Not specified
CNA Linux Linux unaffected 3.9 semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report