CVE-2026-89574: dm array: validate array block headers on read
In the Linux kernel, the following vulnerability has been resolved:
dm array: validate array block headers on read
arrayblockcheck() validates blocknr and csum and nothing else, while nodecheck(), next to it, has bounded the structural fields since both were written. dmarraycursornext() takes its loop bound from the on-disk nrentries and elementat() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dmcacheloadmappings() drives it once per cache block at activation.
Check the header against itself: reject a zero valuesize, require maxentries to equal calcmaxentries() for that valuesize and block size, and require nrentries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUGON() in fillablock() and trimablock(). Metadata dm-array writes satisfies all three.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate dm-array block headers on read: reject a zero value_size, require max_entries to equal calc_max_entries() for the value_size and block size, and require nr_entries to fit within the block capacity.
Event History
Frequently Asked Questions
When is the affected code path exercised?
The path is exercised when dm_cache_load_mappings() runs during dm-cache activation, once for each cache block.
What metadata conditions indicate a problematic array block?
A problematic header can have a zero value_size, a max_entries value that does not equal the calculated capacity for its value_size and block size, or an nr_entries value that exceeds the block’s capacity.
What behavior can malformed metadata trigger before the fix?
An oversized on-disk nr_entries value can keep the cursor on one block while its index advances beyond that block, causing reads to walk off the dm-bufio buffer.