Strix
63.9K

CVE-2026-89573

HIGHCVSS 7.8/10EPSS 0.13%

Last modified

CVE-2026-89573 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. EPSS estimates a 0.13% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.13%

2.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < 35cd3b278448c79614f65ab6bbc9ed348d847df9; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < a8237cb8fa0a628d903e76635bfdeae4202036b9; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < a530a9a419a7c5fdb7dae55ffa2dd7a130631842; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < 522fa26da24ccaa298ebe3c1c97395d2d63dfc21; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < 7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < ac4a5eb8b002a0742c938fc98b922e243f53573a; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < cb409b38b0232ee4385ef55cddcd6fbdd011a8a2; >= 6513c29f44f2cc970c0e9fecfe5a6526c3e73025, < 4538a287bdf5d0f9a379c678e5262b9f5783f547
LinuxLinux3.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89573?
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
How severe is CVE-2026-89573?
CVE-2026-89573 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89573?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89573?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST