CVE-2026-89573: dm array: reject an array block whose value size is not the caller's

Q: What systems are realistically exposed to this issue?

Systems using the Linux kernel device-mapper cache target are exposed only when dm-cache processes crafted metadata. Normal array operation reads only its own blocks, so the issue does not trigger on ordinary internally generated metadata.

Q: What does an attacker need to exploit it?

An attacker needs a way to cause dm-cache to load crafted metadata in which the mappings root points to a hint block. This creates a value-size mismatch between the expected 8-byte mapping entries and 4-byte hint entries.

Q: How can I tell whether a system may already be affected?

Investigate dm-cache metadata for a mappings root that references a hint block or other array block with a different value size than the caller expects. The described condition causes 8-byte traversal over 4-byte entries and can reach beyond the 4096-byte block boundary.

Published Sep 11, 2026

Updated

dm array: reject an array block whose value size is not the caller's

Affected Software

258 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.152.1-1<6.6.157.1-1

6.6.157.1-1

debian/linux<=6.1.176-1, <=6.12.107-1

6.1.190-16.12.115-27.2.12-17.2.15-1

debian/linux-6.12

6.12.113-1~deb12u1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1119.126~20.04.1

5.15.0-1119.126~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1125.134~20.04.1

5.15.0-1125.134~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1124.133~20.04.1

5.15.0-1124.133~20.04.1

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1120.130~20.04.1

5.15.0-1120.130~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-202.212~20.04.1

5.15.0-202.212~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1113.117~20.04.1

5.15.0-1113.117~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1114.120~20.04.1

5.15.0-1114.120~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-197.207~20.04.1

5.15.0-197.207~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1070.72~20.04.1

5.15.0-1070.72~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1116.122~20.04.1

5.15.0-1116.122~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1113.117~20.04.2

5.15.0-1113.117~20.04.2

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-202.212

5.15.0-202.212

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1119.126

5.15.0-1119.126

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure<5.15.0-1125.134

5.15.0-1125.134

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde<5.15.0-1124.133

5.15.0-1124.133

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp<5.15.0-1120.130

5.15.0-1120.130

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-gke<5.15.0-1115.121

5.15.0-1115.121

ubuntu/linux-gkeop<5.15.0-1102.110

5.15.0-1102.110

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1113.117

5.15.0-1113.117

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1114.120

5.15.0-1114.120

ubuntu/linux-kvm<5.15.0-1111.116

5.15.0-1111.116

ubuntu/linux-lowlatency<5.15.0-197.207

5.15.0-197.207

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia<5.15.0-1114.115

5.15.0-1114.115

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra<5.15.0-1070.72

5.15.0-1070.72

ubuntu/linux-nvidia-tegra-igx<5.15.0-1059.59

5.15.0-1059.59

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1116.122

5.15.0-1116.122

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield<5.15.0-1103.105

5.15.0-1103.105

ubuntu/linux-intel-iot-realtime<5.15.0-1111.115

5.15.0-1111.115

ubuntu/linux-realtime<5.15.0-1118.127

5.15.0-1118.127

ubuntu/linux-realtime-6.8*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1119.126+fips1

5.15.0-1119.126+fips1

ubuntu/linux-azure-fips<5.15.0-1125.134+fips1

5.15.0-1125.134+fips1

ubuntu/linux-fips<5.15.0-202.212+fips1

5.15.0-202.212+fips1

ubuntu/linux-gcp-fips<5.15.0-1120.130+fips1

5.15.0-1120.130+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0*

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-42.42~24.04.1

7.0.0-42.42~24.04.1

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0*

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-42.42.1~24.04.1

7.0.0-42.42.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<7.0.0-42.42

7.0.0-42.42

ubuntu/linux-aws<7.0.0-1016.17

7.0.0-1016.17

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-gke*

ubuntu/linux-ibm<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-oracle<7.0.0-1015.16

7.0.0-1015.16

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv<7.0.0-42.42.1

7.0.0-42.42.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.113-1~deb12u1
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1119.126~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1125.134~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1124.133~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.130~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-202.212~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.117~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-197.207~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1070.72~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.122~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.117~20.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-202.212
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1119.126
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1125.134
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1124.133
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.130
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1115.121
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.110
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.117
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.116
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-197.207
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.115
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1070.72
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1059.59
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.122
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1103.105
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.127
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1119.126+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1125.134+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-202.212+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.130+fips1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.16
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1

Event History

Sep 11, 2026

CVE Published

via MITRE·07:44 PM

Data Sourced

via MITRE·07:44 PM

DescriptionSeverity

Data Sourced

via OSV·08:19 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·08:19 PM

DescriptionSeverity

Sep 13, 2026

Data Sourced

via Microsoft·08:08 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6528

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What systems are realistically exposed to this issue?

Systems using the Linux kernel device-mapper cache target are exposed only when dm-cache processes crafted metadata. Normal array operation reads only its own blocks, so the issue does not trigger on ordinary internally generated metadata.

What does an attacker need to exploit it?

An attacker needs a way to cause dm-cache to load crafted metadata in which the mappings root points to a hint block. This creates a value-size mismatch between the expected 8-byte mapping entries and 4-byte hint entries.

How can I tell whether a system may already be affected?

Investigate dm-cache metadata for a mappings root that references a hint block or other array block with a different value size than the caller expects. The described condition causes 8-byte traversal over 4-byte entries and can reach beyond the 4096-byte block boundary.

CVE-2026-89573: dm array: reject an array block whose value size is not the caller's

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a system may already be affected?

Company

Resources

Contact