CVE-2026-89456: s390/dasd: Propagate partial completion length across ERP recovery
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Propagate partial completion length across ERP recovery
dasddefaulterppostaction() copies the timing and device state from the finished ERP request back to the original request but drops procbytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. dasdcleanupcqr() then sees procbytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.
Carry procbytes over to the original request like the other per-request state.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the issue to occur?
The affected request must be an ESE read of a not-yet-allocated track that completes only partially and then goes through ERP recovery. The recovery path can lose the recorded partial-completion length.
What is the practical impact of the incorrect completion handling?
The cleanup path can treat the entire request as complete rather than requeueing the unread remainder. This can silently return zeroed data for the portion that was not read.
How can I determine whether a system has encountered this condition?
Look for cases involving ESE reads of not-yet-allocated DASD tracks that were partially completed and subsequently recovered through the ERP chain, especially where returned data unexpectedly contains zeros for an unread portion. The provided data does not identify a specific log message or diagnostic indicator.