UBUNTU-CVE-2026-89574: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck() validates blocknr and csum and nothing else, while nodecheck(), next to it, has bounded the structural fields since both were written. dmarraycursornext() takes its loop bound from the on-disk nrentries and elementat() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dmcacheloadmappings() drives it once per cache block at activation. Check the header against itself: reject a zero valuesize, require maxentries to equal calcmaxentries() for that valuesize and block size, and require nrentries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUGON() in fillablock() and trimablock(). Metadata dm-array writes satisfies all three.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update dm-array array_block_check() to validate array block headers on read: reject zero value_size, require max_entries to equal calc_max_entries() for the value_size and block size, and require nr_entries to fit within max_entries.