CVE-2026-89573
CVE CVE-2026-89573EUVD EUVD-2026-76485Published 2026-09-11T19:44:41.000ZLast changed 2026-09-14T12:01:06.000ZCVSS 7.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 3.9; patch: 7.2.4; patch: 6.18.50; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <ac4a5eb8b002a0742c938fc98b922e243f53573a; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <a8237cb8fa0a628d903e76635bfdeae4202036b9; patch: 5.15.221; patch: 6.12.109; patch: 5.10.270; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <35cd3b278448c79614f65ab6bbc9ed348d847df9; patch: 7.3-rc1; patch: 6.6.157; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <cb409b38b0232ee4385ef55cddcd6fbdd011a8a2; patch: 6.1.188; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <4538a287bdf5d0f9a379c678e5262b9f5783f547; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <a530a9a419a7c5fdb7dae55ffa2dd7a130631842; patch: 0; 6513c29f44f2cc970c0e9fecfe5a6526c3e73025 <522fa26da24ccaa298ebe3c1c97395d2d63dfc21
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.