HIGH Introduced in 3.9
dm ArrayBlock OOB
CVE-2026-89573
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
02KernelScan AI Analysis
Risk summary
A crafted dm-cache metadata block can cause the kernel to interpret array entries with the wrong element stride, reading and writing far beyond the allocated buffer. An attacker needs root or CAP_SYS_ADMIN to activate a dm-cache target using the crafted metadata, limiting exposure to scenarios where untrusted block devices are fed to device-mapper. The result is kernel heap corruption leading to information disclosure and denial of service.
Vulnerability analysis
The dm-array metadata validator only checks a block's header for internal consistency, so a block whose stored element size differs from what the caller expects passes validation. When dm-cache's mappings root is redirected at a hint block with a smaller element size, the array-walking code strides through the 4096-byte buffer using the larger mapping stride, reaching offsets well past the end of the block and corrupting adjacent kernel heap. The fix adds a cross-check when loading array blocks, rejecting any block whose stored element size does not match what the caller expects. The bug fires only on crafted dm-cache metadata supplied on a block device, and activating a dm-cache target requires CAP_SYS_ADMIN in the init namespace, so an attacker must either have root-level access or compromise a privileged storage management service that configures device-mapper targets.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 3.9 | 7.2.4 | cb409b38b023 |
| mainline | 3.9 | 7.3-rc1 | 4538a287bdf5 |
| 5.10 | 3.9 | 5.10.270 | 35cd3b278448 |
| 6.6 | 3.9 | 6.6.157 | 522fa26da24c |
| 6.12 | 3.9 | 6.12.109 | 7bf4b5cb42a4 |
| 6.1 | 3.9 | 6.1.188 | a530a9a419a7 |
| 5.15 | 3.9 | 5.15.221 | a8237cb8fa0a |
| 6.18 | 3.9 | 6.18.50 | ac4a5eb8b002 |
| cip/6.12 | 3.9 | 6.12.111-cip32 | 7bf4b5cb42a4 |