CVE-2026-89456 Overview
CVE-2026-89456 is a data integrity vulnerability in the Linux kernel's s390 Direct Access Storage Device (DASD) driver. The flaw resides in dasd_default_erp_postaction(), which copies timing and device state from a completed Error Recovery Procedure (ERP) request back to the original request but drops the proc_bytes field. When an Extent Space Efficient (ESE) read of a not-yet-allocated track returns fewer bytes than requested and is then recovered through the ERP chain, the partial-completion length is lost. __dasd_cleanup_cqr() then observes proc_bytes == 0 and completes the whole request, silently returning zeroed data for the portion that was never read.
Critical Impact
Silent data corruption on s390 systems using ESE volumes, where applications receive zero-filled buffers instead of valid storage data with no error indication.
Affected Products
- Linux kernel s390/dasd subsystem
- IBM Z (s390x) systems using Extent Space Efficient (ESE) DASD volumes
- Distributions shipping affected kernel versions prior to the referenced stable commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89456 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89456
Vulnerability Analysis
The defect is a per-request state propagation error in the Linux kernel DASD driver on the s390 architecture. When an I/O request fails and enters the ERP chain, the driver builds a recovery request. On completion of that recovery request, dasd_default_erp_postaction() copies selected fields, such as timing and device state, back to the original Channel Queue Request (CQR). The proc_bytes counter, which records how many bytes of the original request were successfully processed before the failure, is not copied. This omission is a kernel-level [Local Code Execution] logic bug that manifests as silent data corruption rather than a crash.
Root Cause
The root cause is missing state propagation in dasd_default_erp_postaction(). The function updates the original request with recovery metadata but omits proc_bytes. When __dasd_cleanup_cqr() later evaluates completion, it reads proc_bytes == 0 on the original CQR and treats the request as fully complete rather than requeueing the outstanding remainder. The fix carries proc_bytes across ERP recovery like the other per-request state.
Attack Vector
Exploitation requires local access with permissions that generate DASD I/O against ESE volumes. Triggering the condition requires an ESE read against a not-yet-allocated track that returns short, followed by an ERP recovery path. The result is that applications and filesystems receive zero-filled buffers in place of the untransferred portion, undermining data integrity for downstream users, databases, and filesystems that rely on the read succeeding fully or failing loudly.
No synthetic exploitation code is provided. Refer to the upstream commits linked in the references for the exact code paths and fix.
Detection Methods for CVE-2026-89456
Indicators of Compromise
- Unexpected zero-filled regions in files or database pages read from ESE DASD volumes.
- Filesystem or application-level checksum mismatches following ERP recovery events on s390.
- Kernel messages indicating DASD ERP activity correlated with subsequent data-integrity errors.
Detection Strategies
- Inventory s390x hosts and identify kernels lacking the referenced stable commits such as 15ec0345, 6b0954c8, 6fb5ba2e, 9e063165, ceafb262, d0a2f97d, d6b8778b, and f735b971.
- Correlate DASD ERP recovery events in dmesg and /var/log/messages with application-reported I/O anomalies.
- Run periodic integrity verification, such as filesystem fsck and application-level checksums, on ESE-backed volumes.
Monitoring Recommendations
- Collect kernel logs for dasd and ERP subsystem messages into a centralized logging pipeline.
- Alert on repeated ERP recovery cycles targeting ESE volumes, which increase the probability of triggering the defect.
- Track kernel version drift across the s390 fleet to detect hosts running unpatched builds.
How to Mitigate CVE-2026-89456
Immediate Actions Required
- Apply the kernel update from your Linux distribution that includes the upstream s390/dasd ERP proc_bytes propagation fix.
- Prioritize s390x systems that use ESE DASD volumes and workloads sensitive to silent data corruption such as databases and filesystems.
- Validate data integrity on affected volumes after patching to confirm no residual corruption from earlier ERP events.
Patch Information
The fix propagates proc_bytes from the completed ERP request back to the original request in dasd_default_erp_postaction(), ensuring __dasd_cleanup_cqr() correctly requeues the remainder instead of completing the request with zeroed data. See the upstream stable commits: Kernel Git Commit 15ec0345, Kernel Git Commit 6b0954c8, Kernel Git Commit 6fb5ba2e, Kernel Git Commit 9e063165, Kernel Git Commit ceafb262, Kernel Git Commit d0a2f97d, Kernel Git Commit d6b8778b, and Kernel Git Commit f735b971.
Workarounds
- No reliable software workaround exists; patching the kernel is the supported remediation path.
- Where patching must be delayed, restrict workloads that perform reads against not-yet-allocated ESE tracks and increase integrity checks on affected volumes.
- Take verified backups before running workloads on unpatched kernels and validate restored data against known-good checksums.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.