CVE-2026-89557 (GCVE-0-2026-89557)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48
VLAI
Title
md: do overflow check for sb->bblog_shift in super_1_load()
Summary
In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence, 1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 1938 break; 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1)) 1940 return -EINVAL; 1941 } bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for an invalid bb->bblog_shit, it is possible to make sector be overflowed by the following calculation, 1935 sector <<= sb->bblog_shift; Then in turn when call badblocks_set() at line 1939 with the invalid rdev->badblocks.shift set at line 1930, may result an overflow inside _badblocks_clear() in block/badblocks.c. Although there are many places to call badblocks APIs, the non-zero shift value is only used in super_1_load(), other places always use 0 as the shift value. Therefore it is unnecessary to do a general shift value overflow check inside badblock API, and just check here as the caller. This may avoid unnecessary check, make the badblocks API code more simple and elegant.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:24 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7061 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 94c820d99a4305d4ded41a97ed37ec7d26c56e7f (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 573fb68105fdc6a127ba6069e58a0d2aff3c9f93 (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 323f3a056dbccb39a642ebde642044a680f3a6d6 (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 0a03f9541c06fda64301dcf94f376f07ce2cc396 (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 75d15738fd33a782606d0dc80cfeff47edf2ddd8 (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 3b097416b4cff77285c1f472fc2c4058d8a7554f (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < df7d4d011d5ace20699ea948712f09f9ac08924f (git)
Affected: 2699b67223aca6b1450fc2f72e40fada952afc85 , < 35d522bd32462afcf1981dab6da8a9256c26c1e0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89557",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:24:07.440563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:43.920Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94c820d99a4305d4ded41a97ed37ec7d26c56e7f",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "573fb68105fdc6a127ba6069e58a0d2aff3c9f93",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "323f3a056dbccb39a642ebde642044a680f3a6d6",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "0a03f9541c06fda64301dcf94f376f07ce2cc396",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "75d15738fd33a782606d0dc80cfeff47edf2ddd8",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "3b097416b4cff77285c1f472fc2c4058d8a7554f",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "df7d4d011d5ace20699ea948712f09f9ac08924f",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            },
            {
              "lessThan": "35d522bd32462afcf1981dab6da8a9256c26c1e0",
              "status": "affected",
              "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: do overflow check for sb-\u003ebblog_shift in super_1_load()\n\nIn super_1_load(), sb-\u003ebblog_shift is an __u8 type value loaded from on-\ndisk superblock. It is used for badblocks API badblocks_set() by the\nfollowing sequence,\n\n 1930   rdev-\u003ebadblocks.shift = sb-\u003ebblog_shift;\n 1931   for (i = 0 ; i \u003c (sectors \u003c\u003c (9-3)) ; i++, bbp++) {\n 1932           u64 bb = le64_to_cpu(*bbp);\n 1933           int count = bb \u0026 (0x3ff);\n 1934           u64 sector = bb \u003e\u003e 10;\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\n 1936           count \u003c\u003c= sb-\u003ebblog_shift;\n 1937           if (bb + 1 == 0)\n 1938                   break;\n 1939           if (!badblocks_set(\u0026rdev-\u003ebadblocks, sector, count, 1))\n 1940                   return -EINVAL;\n 1941   }\n\nbb-\u003ebblog_shit is in range of 0-255, variable sector is 64bit width, for\nan invalid bb-\u003ebblog_shit, it is possible to make sector be overflowed\nby the following calculation,\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\nThen in turn when call badblocks_set() at line 1939 with the invalid\nrdev-\u003ebadblocks.shift set at line 1930, may result an overflow inside\n_badblocks_clear() in block/badblocks.c.\n\nAlthough there are many places to call badblocks APIs, the non-zero\nshift value is only used in super_1_load(), other places always use 0 as\nthe shift value. Therefore it is unnecessary to do a general shift value\noverflow check inside badblock API, and just check here as the caller.\n\nThis may avoid unnecessary check, make the badblocks API code more simple\nand elegant."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - super_1_load() parses an MD v1 superblock and bad-block log from a local block device via md_import_device() (ADD_NEW_DISK ioctl, sysfs new_dev, udev/mdadm incremental, or boot autodetect), not a network protocol handler such as ksmbd, nfsd, or in-kernel TCP.\nAC:L - The attacker fully controls on-disk bblog_shift (an unchecked __u8, 0-255) and the bad-block log and can set a valid sb_csum; importing that RAID member deterministically overflows sector/count shifts and badblocks rounding with no race or attacker-uncontrollable layout.\nPR:L - md ioctls/sysfs require CAP_SYS_ADMIN, but an unprivileged local user can present a crafted RAID member (udisks loop-setup or equivalent); default udev mdadm --incremental then runs as root and the kernel parses the superblock, so init-namespace root is not required of the attacker.\nUI:N - The attacker attaches and triggers parse of their own crafted image (loop/udisks) themselves; automated udev/mdadm incremental assembly does not require a separate victim to open a file or confirm a prompt.\nS:U - Impact stays in the host kernel MD/badblocks code and that system\u0027s storage; this is ordinary same-host kernel memory corruption or denial of service, not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - Overflowed bblog_shift poisons rdev-\u003ebadblocks.shift and BB_MAKE() encodings in the kernel badblocks table; later badblocks_set/clear/check and raid1/raid10 I/O use those corrupted entries and over-wide shifts, which is kernel memory corruption that can be leveraged for information disclosure.\nI:H - The same overflow writes corrupted badblocks slots (BB_MAKE with wrapped start/len, including all-ones on zero length) and feeds raid1/raid10 narrow_write_error() a bogus 1\u003c\u003cshift block size, giving kernel-state corruption and mis-sized writes exploitable for integrity and control-flow impact.\nA:H - A crafted shift can divide-by-zero in rounddown/roundup, hit BUG() in front_clear(), hard-lock a CPU in _badblocks_set/_badblocks_clear while holding a seqlock with IRQs off, or oops on undefined over-wide shifts, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:50.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396"
        },
        {
          "url": "https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f"
        },
        {
          "url": "https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f"
        },
        {
          "url": "https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0"
        }
      ],
      "title": "md: do overflow check for sb-\u003ebblog_shift in super_1_load()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89557",
    "datePublished": "2026-09-11T19:44:29.857Z",
    "dateReserved": "2026-09-11T19:38:34.724Z",
    "dateUpdated": "2026-10-19T08:48:50.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89557",
      "date": "2026-10-23",
      "epss": "0.00169",
      "percentile": "0.05907"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/md.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "94c820d99a4305d4ded41a97ed37ec7d26c56e7f",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "573fb68105fdc6a127ba6069e58a0d2aff3c9f93",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "323f3a056dbccb39a642ebde642044a680f3a6d6",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a03f9541c06fda64301dcf94f376f07ce2cc396",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "75d15738fd33a782606d0dc80cfeff47edf2ddd8",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b097416b4cff77285c1f472fc2c4058d8a7554f",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df7d4d011d5ace20699ea948712f09f9ac08924f",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35d522bd32462afcf1981dab6da8a9256c26c1e0",
                    "status": "affected",
                    "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/md.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.1"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: do overflow check for sb-\u003ebblog_shift in super_1_load()\n\nIn super_1_load(), sb-\u003ebblog_shift is an __u8 type value loaded from on-\ndisk superblock. It is used for badblocks API badblocks_set() by the\nfollowing sequence,\n\n 1930   rdev-\u003ebadblocks.shift = sb-\u003ebblog_shift;\n 1931   for (i = 0 ; i \u003c (sectors \u003c\u003c (9-3)) ; i++, bbp++) {\n 1932           u64 bb = le64_to_cpu(*bbp);\n 1933           int count = bb \u0026 (0x3ff);\n 1934           u64 sector = bb \u003e\u003e 10;\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\n 1936           count \u003c\u003c= sb-\u003ebblog_shift;\n 1937           if (bb + 1 == 0)\n 1938                   break;\n 1939           if (!badblocks_set(\u0026rdev-\u003ebadblocks, sector, count, 1))\n 1940                   return -EINVAL;\n 1941   }\n\nbb-\u003ebblog_shit is in range of 0-255, variable sector is 64bit width, for\nan invalid bb-\u003ebblog_shit, it is possible to make sector be overflowed\nby the following calculation,\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\nThen in turn when call badblocks_set() at line 1939 with the invalid\nrdev-\u003ebadblocks.shift set at line 1930, may result an overflow inside\n_badblocks_clear() in block/badblocks.c.\n\nAlthough there are many places to call badblocks APIs, the non-zero\nshift value is only used in super_1_load(), other places always use 0 as\nthe shift value. Therefore it is unnecessary to do a general shift value\noverflow check inside badblock API, and just check here as the caller.\n\nThis may avoid unnecessary check, make the badblocks API code more simple\nand elegant."
          }
        ],
        "id": "CVE-2026-89557",
        "lastModified": "2026-10-19T09:17:51.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-89557",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:24:07.440563Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-11T20:19:39.403",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-17T21:29:38+00:00",
      "cve": "CVE-2026-89557",
      "id": "CVE-2026-89557",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md: do overflow check for sb-\u003ebblog_shift in super_1_load()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89557.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-17T16:25:17Z",
      "cve": "CVE-2026-89557",
      "id": "CVE-2026-89557",
      "initial_release_date": "2026-09-16T00:02:05Z",
      "product_status:known_affected": "350",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89557",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-89557.json",
      "version": "4"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-89557",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T19:24:07.440563Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T19:24:08.001Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/md/md.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "94c820d99a4305d4ded41a97ed37ec7d26c56e7f",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "573fb68105fdc6a127ba6069e58a0d2aff3c9f93",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "323f3a056dbccb39a642ebde642044a680f3a6d6",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "0a03f9541c06fda64301dcf94f376f07ce2cc396",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "75d15738fd33a782606d0dc80cfeff47edf2ddd8",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "3b097416b4cff77285c1f472fc2c4058d8a7554f",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "df7d4d011d5ace20699ea948712f09f9ac08924f",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                },
                {
                  "lessThan": "35d522bd32462afcf1981dab6da8a9256c26c1e0",
                  "status": "affected",
                  "version": "2699b67223aca6b1450fc2f72e40fada952afc85",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/md/md.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.1"
                },
                {
                  "lessThan": "3.1",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.270",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.221",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.188",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.157",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.50",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.*",
                  "status": "unaffected",
                  "version": "7.2.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.270",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.221",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.188",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.157",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.109",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.50",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2.4",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.3",
                      "versionStartIncluding": "3.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: do overflow check for sb-\u003ebblog_shift in super_1_load()\n\nIn super_1_load(), sb-\u003ebblog_shift is an __u8 type value loaded from on-\ndisk superblock. It is used for badblocks API badblocks_set() by the\nfollowing sequence,\n\n 1930   rdev-\u003ebadblocks.shift = sb-\u003ebblog_shift;\n 1931   for (i = 0 ; i \u003c (sectors \u003c\u003c (9-3)) ; i++, bbp++) {\n 1932           u64 bb = le64_to_cpu(*bbp);\n 1933           int count = bb \u0026 (0x3ff);\n 1934           u64 sector = bb \u003e\u003e 10;\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\n 1936           count \u003c\u003c= sb-\u003ebblog_shift;\n 1937           if (bb + 1 == 0)\n 1938                   break;\n 1939           if (!badblocks_set(\u0026rdev-\u003ebadblocks, sector, count, 1))\n 1940                   return -EINVAL;\n 1941   }\n\nbb-\u003ebblog_shit is in range of 0-255, variable sector is 64bit width, for\nan invalid bb-\u003ebblog_shit, it is possible to make sector be overflowed\nby the following calculation,\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\nThen in turn when call badblocks_set() at line 1939 with the invalid\nrdev-\u003ebadblocks.shift set at line 1930, may result an overflow inside\n_badblocks_clear() in block/badblocks.c.\n\nAlthough there are many places to call badblocks APIs, the non-zero\nshift value is only used in super_1_load(), other places always use 0 as\nthe shift value. Therefore it is unnecessary to do a general shift value\noverflow check inside badblock API, and just check here as the caller.\n\nThis may avoid unnecessary check, make the badblocks API code more simple\nand elegant."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - super_1_load() parses an MD v1 superblock and bad-block log from a local block device via md_import_device() (ADD_NEW_DISK ioctl, sysfs new_dev, udev/mdadm incremental, or boot autodetect), not a network protocol handler such as ksmbd, nfsd, or in-kernel TCP.\nAC:L - The attacker fully controls on-disk bblog_shift (an unchecked __u8, 0-255) and the bad-block log and can set a valid sb_csum; importing that RAID member deterministically overflows sector/count shifts and badblocks rounding with no race or attacker-uncontrollable layout.\nPR:L - md ioctls/sysfs require CAP_SYS_ADMIN, but an unprivileged local user can present a crafted RAID member (udisks loop-setup or equivalent); default udev mdadm --incremental then runs as root and the kernel parses the superblock, so init-namespace root is not required of the attacker.\nUI:N - The attacker attaches and triggers parse of their own crafted image (loop/udisks) themselves; automated udev/mdadm incremental assembly does not require a separate victim to open a file or confirm a prompt.\nS:U - Impact stays in the host kernel MD/badblocks code and that system\u0027s storage; this is ordinary same-host kernel memory corruption or denial of service, not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - Overflowed bblog_shift poisons rdev-\u003ebadblocks.shift and BB_MAKE() encodings in the kernel badblocks table; later badblocks_set/clear/check and raid1/raid10 I/O use those corrupted entries and over-wide shifts, which is kernel memory corruption that can be leveraged for information disclosure.\nI:H - The same overflow writes corrupted badblocks slots (BB_MAKE with wrapped start/len, including all-ones on zero length) and feeds raid1/raid10 narrow_write_error() a bogus 1\u003c\u003cshift block size, giving kernel-state corruption and mis-sized writes exploitable for integrity and control-flow impact.\nA:H - A crafted shift can divide-by-zero in rounddown/roundup, hit BUG() in front_clear(), hard-lock a CPU in _badblocks_set/_badblocks_clear while holding a seqlock with IRQs off, or oops on undefined over-wide shifts, fully denying availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-19T08:48:50.070Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f"
            },
            {
              "url": "https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93"
            },
            {
              "url": "https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6"
            },
            {
              "url": "https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396"
            },
            {
              "url": "https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8"
            },
            {
              "url": "https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f"
            },
            {
              "url": "https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f"
            },
            {
              "url": "https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0"
            }
          ],
          "title": "md: do overflow check for sb-\u003ebblog_shift in super_1_load()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-89557",
        "datePublished": "2026-09-11T19:44:29.857Z",
        "dateReserved": "2026-09-11T19:38:34.724Z",
        "dateUpdated": "2026-10-19T08:48:50.070Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.