HIGH
dasd ERP Postaction Corruption
CVE-2026-89456
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
02KernelScan AI Analysis
Risk summary
s390 DASD thin-provisioned (ESE) volumes can silently return zeroed data for portions of read requests that were partially completed and then recovered through the ERP chain. Any local process with read access to an affected DASD device can trigger this by reading from an unformatted track region. The result is silent data corruption: applications receive zeros instead of the correct data.
Vulnerability analysis
When a read request to a thin-provisioned (ESE) DASD volume partially completes—because it encounters an unformatted track—and then goes through error recovery processing (ERP), the partial-completion byte count is not propagated back to the original request. The cleanup logic then sees zero bytes processed and completes the entire request as if fully done, silently filling the unread portion with zeros instead of requeueing the remainder. The fix carries the partial-completion length back to the original request alongside the other per-request state, so the remainder is correctly requeued. This is reachable by any local process that can read from an affected DASD block device on s390 hardware with ESE-formatted volumes.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.5 | 5.5.10 | 5.6 | 6b0954c8a259 |
| 6.12 | — | 6.12.109 | 15ec03452c18 |
| 6.18 | — | 6.18.50 | 6fb5ba2e7e43 |
| 7.2 | — | 7.2.4 | — |
| mainline | — | 7.3-rc1 | — |
| 5.4 | 5.4.26 | 5.5 | 9e063165d3fe |
| 5.15 | — | 5.15.221 | f735b9710f0c |
| 6.6 | — | 6.6.157 | ceafb262475a |
| 5.10 | — | 5.10.270 | d0a2f97d8c97 |
| 6.1 | — | 6.1.188 | d6b8778b1b82 |
| cip/6.12 | — | 6.12.111-cip32 | d6b8778b1b82 |