{"id":"CVE-2026-89573","revision":"d4a7b3caf08649258244c899c15a9267","records":[{"revision":"d4a7b3caf08649258244c899c15a9267","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89573","aliases":[],"title":"dm array: reject an array block whose value size is not the caller's","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: reject an array block whose value size is not the caller's\n\narray_block_check() can only compare the header against itself, so a block\nwith value_size 4 and max_entries 1018 is internally consistent and passes.\ndm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the\nroots for both live in the superblock. Point the mappings root at a hint\nblock and __load_mappings() walks it through an info whose value size is 8,\nso element_at() strides 8 bytes over 4-byte entries and reaches offset 8160\nof a 4096-byte block.\n\nget_ablock() and __shadow_ablock() are the two places that hold the block\nand the caller at once. Reject there when the two value sizes disagree.\nArrays only ever read their own blocks, so this fires on crafted metadata\nonly.","state":0,"publishedAt":"2026-09-11T19:44:41.851+00:00","modifiedAt":"2026-10-19T08:49:06.476+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/persistent-data/dm-array.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"35cd3b278448c79614f65ab6bbc9ed348d847df9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"a8237cb8fa0a628d903e76635bfdeae4202036b9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"a530a9a419a7c5fdb7dae55ffa2dd7a130631842\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"522fa26da24ccaa298ebe3c1c97395d2d63dfc21\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"ac4a5eb8b002a0742c938fc98b922e243f53573a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"cb409b38b0232ee4385ef55cddcd6fbdd011a8a2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6513c29f44f2cc970c0e9fecfe5a6526c3e73025\",\n                            \"lessThan\": \"4538a287bdf5d0f9a379c678e5262b9f5783f547\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/persistent-data/dm-array.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/35cd3b278448c79614f65ab6bbc9ed348d847df9","https://git.kernel.org/stable/c/a8237cb8fa0a628d903e76635bfdeae4202036b9","https://git.kernel.org/stable/c/a530a9a419a7c5fdb7dae55ffa2dd7a130631842","https://git.kernel.org/stable/c/522fa26da24ccaa298ebe3c1c97395d2d63dfc21","https://git.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c","https://git.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573a","https://git.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2","https://git.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89573","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89573","identifiers":["CVE-2026-89573"]},"retained":false,"historicalAffected":[]}],"coverage":[]}