Out-of-bounds read in Linux kernel - CVE-2026-89573

Vulnerability details

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper validation of array block value sizes in dm-array's get_ablock() and __shadow_ablock() functions when processing crafted dm-cache metadata. A local user can cause a mappings array to reference a hint block with a smaller value size to read out-of-bounds memory.

Affected software

How to mitigate CVE-2026-89573

External References

• https://git.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547
• https://git.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c
• https://git.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573a
• https://git.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2

Related Security Bulletins

• Out-of-bounds read in Linux kernel md persistent-data driver