CVE-2026-89458: s390/dasd: Do not complete a failed ESE read as successful
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Do not complete a failed ESE read as successful
dasdinthandler() completes an NRF read of an unallocated ESE track by calling eseread() and unconditionally marking the request DASDCQRSUCCESS. dasdeckdeseread() can return an error before it has zeroed the destination buffer: a failed sense-data parse or a current track outside the requested range both return early, leaving the destination pages untouched. The request is still completed successfully, so the block layer is handed stale / uninitialized memory instead of zeros.
Check the eseread() return value and fail the request through the normal error path instead of forcing DASDCQRSUCCESS.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel s390 DASD driver are exposed when an NRF read targets an unallocated ESE track and the ESE read helper fails before zeroing the destination buffer.
What does an attacker or triggering condition need to cause the problem?
The issue requires an NRF read of an unallocated ESE track plus an error in the ESE read path, such as failed sense-data parsing or a current track outside the requested range. Under those conditions, the request can be reported as successful even though its destination pages were not initialized.
What is the impact of a successful-looking failed read?
The block layer may receive stale or uninitialized memory rather than the expected zero-filled data. This can expose data present in the destination pages and can cause consumers to treat invalid read data as valid.
How can administrators mitigate the issue if they cannot apply the fix immediately?
The provided information identifies the affected path as s390 DASD NRF reads involving unallocated ESE tracks. Avoiding workloads or configurations that issue those reads is the only mitigation supported by the available data; the permanent fix is to fail the request when ese_read() returns an error.