CVE-2026-89584: block: validate user space vectors during extraction
In the Linux kernel, the following vulnerability has been resolved:
block: validate user space vectors during extraction
The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dmaalignment as the bio is built from the ioviter, rejecting misaligned early with -EINVAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using affected Linux kernel block I/O paths with bio-based or stacking block drivers may be exposed when user-space I/O vectors are not aligned to the underlying device's DMA alignment requirements.
What does an attacker or triggering workload need to do?
The triggering condition is a user-space I/O vector that is misaligned for the target device's dma_alignment. The issue occurs during construction of a bio from an iov_iter, before the corrected code rejects the request with -EINVAL.
What is the mitigation if the fix cannot be deployed immediately?
The provided information does not specify a configuration workaround. Avoiding or rejecting misaligned user-space I/O vectors for devices with DMA alignment requirements may reduce exposure, but the documented resolution is kernel-side validation.