CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

libnvdimm/labels: Prevent integer overflow in ndlabelvalidate()

The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate() bounds it against the config area size, but sizeofnamespacelabel() returns unsigned, so the product nslot labelsize is evaluated in 32-bit and wraps modulo 2^32 before the comparison. A crafted nslot passes the bound and is then used as the loop trip count in ndlabeldatainit(), whose memset() walks off the end of the configsize buffer: an out-of-bounds write.

The field is not trusted -- it comes from the medium, or from userspace via NDCMDSETCONFIGDATA. Evaluate the product in 64-bit so the bound check is exact; conforming labels are unaffected.

The check was safe when introduced by commit 4a826c83db4e ("libnvdimm: namespace indices: read and validate"): it multiplied by sizeof(struct ndnamespacelabel), a sizet, so on a 64-bit build the product did not wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions") narrowed it to 32 bits when the label size became a runtime value read via sizeofnamespacelabel().

Affected Software

1 affected component
Linux Kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the out-of-bounds write?

An attacker needs control over the on-media NVDIMM namespace index field nslot, either through crafted DIMM label storage contents or by supplying configuration data through the ND_CMD_SET_CONFIG_DATA userspace interface. The crafted value must cause the 32-bit nslot × label-size calculation to wrap and bypass validation.

2

Who is exposed to this issue?

Systems using the Linux kernel libnvdimm label-handling code are exposed when they process untrusted or attacker-controlled DIMM label storage or permit an attacker to submit configuration data through ND_CMD_SET_CONFIG_DATA. Conforming labels are unaffected.

3

How can I determine whether a system may already be affected?

Review whether the system has processed untrusted NVDIMM label media or configuration data provided through ND_CMD_SET_CONFIG_DATA. The provided data does not include a detection method for confirming prior exploitation or identifying malicious labels after processing.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203