{"api_version":"1","generated_at":"2026-09-14T04:18:08+00:00","cve":"CVE-2026-89456","urls":{"html":"https://cve.report/CVE-2026-89456","api":"https://cve.report/api/cve/CVE-2026-89456.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89456","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89456"},"summary":{"title":"s390/dasd: Propagate partial completion length across ERP recovery","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:26","updated_at":"2026-09-13 07:17:09"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14","name":"https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b","name":"https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2","name":"https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99","name":"https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89456","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89456","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5e6bdd37c5526ef01326df5dabb93011ee89237e d6b8778b1b82aa3a8dbf8612080f635b834bd16b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5e6bdd37c5526ef01326df5dabb93011ee89237e ceafb262475ac6cb3a7d07b1102608be2b216b99 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5e6bdd37c5526ef01326df5dabb93011ee89237e 15ec03452c18e8d288e519837d21b308300d74b2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5e6bdd37c5526ef01326df5dabb93011ee89237e 6fb5ba2e7e43173a3761e46f091070a8185efa14 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5f7c9989f11305aaa43e0f4378f4f070022a9f2b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.26 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5.10 5.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.6","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"89456","cve":"CVE-2026-89456","epss":"0.001440000","percentile":"0.040390000","score_date":"2026-09-13","updated_at":"2026-09-14 00:18:01"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/block/dasd_erp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6b8778b1b82aa3a8dbf8612080f635b834bd16b","status":"affected","version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","versionType":"git"},{"lessThan":"ceafb262475ac6cb3a7d07b1102608be2b216b99","status":"affected","version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","versionType":"git"},{"lessThan":"15ec03452c18e8d288e519837d21b308300d74b2","status":"affected","version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","versionType":"git"},{"lessThan":"6fb5ba2e7e43173a3761e46f091070a8185efa14","status":"affected","version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","versionType":"git"},{"status":"affected","version":"fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04","versionType":"git"},{"status":"affected","version":"5f7c9989f11305aaa43e0f4378f4f070022a9f2b","versionType":"git"},{"lessThan":"5.5","status":"affected","version":"5.4.26","versionType":"semver"},{"lessThan":"5.6","status":"affected","version":"5.5.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/block/dasd_erp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the s390 DASD block driver's ERP postaction and is reached only by local block I/O to an ESE (thin-provisioned) volume, via a DASD-backed filesystem or /dev/dasd*; no ksmbd, nfsd, or packet path parses attacker data into this code.\nAC:H - Exploitation needs an ESE NRF partial read whose CQR is an ERP retry, so a prior hardware-reported unit check or similar recoverable error must occur; the attacker cannot inject sense data or craft CCWs, which the driver builds itself.\nPR:L - Unprivileged local users trigger the path through ordinary read/write syscalls on files stored on a DASD-backed filesystem; dasd_open and do_dasd_request impose no capability check on that I/O path.\nUI:N - The attacker performs the I/O themselves; no second user must mount a volume, open a file, or otherwise interact.\nS:U - Incorrect request completion affects host kernel block I/O and page-cache contents on the same LPAR; it is not a KVM/vfio-ccw guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Dropping proc_bytes completes the unread remainder as success, so page-cache pages the driver never filled — stale previously freed kernel or other tenants' memory — are marked uptodate and returned to userspace as valid file data.\nI:H - Tracks after the unallocated ESE hole are never fetched yet the whole request succeeds, substituting zeros or stale bytes for real disk contents that filesystems may write back, permanently corrupting co-resident file data and metadata.\nA:H - Successful completion of filesystem, journal, or executable reads with zeros or stale data can corrupt metadata parsers and trigger ext4 errors=panic or XFS forced shutdown, taking IBM Z/LinuxONE storage nodes down."}]}],"providerMetadata":{"dateUpdated":"2026-09-13T06:29:32.532Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"},{"url":"https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99"},{"url":"https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2"},{"url":"https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14"}],"title":"s390/dasd: Propagate partial completion length across ERP recovery","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89456","datePublished":"2026-09-11T19:43:20.037Z","dateReserved":"2026-09-11T19:38:34.707Z","dateUpdated":"2026-09-13T06:29:32.532Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:26","lastModifiedDate":"2026-09-13 07:17:09","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89456","Ordinal":"1","Title":"s390/dasd: Propagate partial completion length across ERP recove","CVE":"CVE-2026-89456","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89456","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state.","Type":"Description","Title":"s390/dasd: Propagate partial completion length across ERP recove"}]}}}