HIGH Introduced in 4.2
nvdimm Arena OOB
CVE-2026-89965
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree. A crafted or foreign arena whose nfree is below the lane count makes freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write. btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the code does not currently honor: num_lanes is ND_MAX_LANES regardless of nfree. Reject an arena whose nfree is below num_lanes at discovery, before the per-lane arrays are allocated, enforcing that invariant.
02KernelScan AI Analysis
Risk summary
A crafted NVDIMM with a malformed BTT info block can cause an out-of-bounds write in the kernel when the BTT driver discovers arenas. Systems using NVDIMM persistent memory with BTT are at risk if an attacker can place a crafted info block on the device, either through physical access or root-level writes to the raw block device. The result is kernel heap corruption, potentially leading to code execution or a system crash.
Vulnerability analysis
The BTT driver reads metadata from the NVDIMM medium without validating a size field that controls how large it makes its internal per-lane bookkeeping arrays. The I/O path later indexes those arrays using a lane number that can exceed the allocated size. A crafted or foreign NVDIMM that reports too few reserve free blocks causes the driver to write past the end of those arrays during normal operation. The fix validates the size field during arena discovery and refuses any arena that would violate the documented minimum, so the arrays are never allocated too small. An attacker can trigger this by inserting a tampered NVDIMM, or by a local privileged user writing a crafted info block to the raw block device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.2 | 5.10.270 | eb491343d2d1 |
| 5.15 | 4.2 | 5.15.221 | 59d5cd1f42b4 |
| 6.1 | 4.2 | 6.1.188 | f6c5313aae79 |
| 6.12 | 4.2 | 6.12.110 | 6f79d1a5f261 |
| 6.18 | 4.2 | 6.18.51 | 6b1faf1f099f |
| 6.6 | 4.2 | 6.6.157 | f9bf05c63b77 |
| 7.2 | 4.2 | 7.2.5 | 9dfa11cef475 |
| mainline | 4.2 | 7.3 | 6a1f2e5ed926 |
| cip/5.10 | 4.2 | 5.10.271-cip78 | eb491343d2d1 |
| cip/6.1 | 4.2 | 6.1.189-cip61 | f6c5313aae79 |
| cip/6.1-rt | 4.2 | 6.1.189-cip61-rt32 | f6c5313aae79 |
| cip/6.12 | 4.2 | 6.12.111-cip32 | 6f79d1a5f261 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |