CVE-2026-89458: Linux Kernel DASD ESE Read Vulnerability

CVE-2026-89458 Overview

CVE-2026-89458 is a Linux kernel vulnerability in the s390 Direct Access Storage Device (DASD) driver. The flaw resides in dasd_int_handler(), which unconditionally marks Extent Space Efficient (ESE) read requests as DASD_CQR_SUCCESS even when dasd_eckd_ese_read() returns an error before zeroing the destination buffer. When a sense-data parse fails or the current track lies outside the requested range, the function returns early and leaves destination pages untouched. The block layer then receives stale or uninitialized kernel memory instead of zeros, resulting in an information disclosure condition on IBM Z (s390) systems using ESE volumes.

Critical Impact
The block layer receives uninitialized kernel memory in place of zeroed data, which can expose sensitive contents of previously used pages to userspace on affected s390 systems.

Affected Products

Linux kernel with s390 DASD driver support
IBM Z systems using ESE (Extent Space Efficient) volumes
Kernel branches referenced in the stable commits listed under external references

Discovery Timeline

2026-09-11 - CVE-2026-89458 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89458

Vulnerability Analysis

The vulnerability affects the s390 DASD block driver, which manages IBM Z direct-access storage. ESE volumes allocate tracks on demand, and reads targeting unallocated tracks trigger a No Record Found (NRF) condition. The interrupt handler dasd_int_handler() responds by invoking ese_read() to synthesize zeroed data for the caller, then marks the channel program request as successful.

The flaw is an uninitialized memory use [CWE-908] combined with improper error handling [CWE-755]. The handler ignores the return value from dasd_eckd_ese_read(). When that function fails early, the destination buffer pages allocated for the block I/O request retain whatever data was previously stored there. Because the request is completed with DASD_CQR_SUCCESS, the block layer treats the buffer as valid and returns it up the I/O stack.

Root Cause

The root cause is an unconditional success marking of a channel program request in the DASD interrupt path. dasd_eckd_ese_read() has two documented early-return conditions: a failed sense-data parse, and a current track that falls outside the requested range. In both paths, the function returns before executing the memset that zeroes the destination pages, yet the caller does not inspect the return code.

Attack Vector

Exploitation requires local access to a Linux s390 system backed by ESE DASD volumes and the ability to issue reads against unallocated tracks that trigger the failing code paths in dasd_eckd_ese_read(). The result is disclosure of residual kernel heap or page contents to the block layer, which may surface to userspace through normal read operations. The vulnerability does not permit code execution or write-side corruption; the impact is confined to information disclosure. No public proof-of-concept is available at the time of publication.

The vulnerability manifests entirely within the kernel storage stack. No synthetic exploit code is presented here; readers should refer to the upstream stable commits linked in the references for the exact code paths and the applied fix.

Detection Methods for CVE-2026-89458

Indicators of Compromise

Unexpected NRF (No Record Found) sense data logged by the DASD driver on ESE volumes
Kernel messages from the dasd subsystem referencing ESE read handling or sense-parse failures
Applications reading from ESE-backed block devices receiving non-zero data in regions expected to be sparse

Detection Strategies

Inventory s390 hosts and identify which volumes are provisioned as ESE to scope exposure
Compare running kernel versions against the fixed commits listed in kernel.org stable references
Audit dmesg and journalctl -k output for DASD ESE-related warnings or sense-data parse errors

Monitoring Recommendations

Forward kernel logs from s390 guests and LPARs to a centralized logging platform and alert on DASD sense-data anomalies
Track kernel package versions across s390 fleets and flag hosts running unpatched builds
Monitor block I/O error counters on ESE volumes for unusual completion patterns

How to Mitigate CVE-2026-89458

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the CVE record to all affected s390 systems
Prioritize remediation on hosts where ESE volumes carry multi-tenant or sensitive workloads
Restart affected guests or LPARs after installing the patched kernel to load the corrected driver

Patch Information

The fix modifies dasd_int_handler() to check the return value of ese_read() and route failures through the normal error path rather than forcing DASD_CQR_SUCCESS. The corrected behavior ensures that failed ESE reads propagate an error to the block layer instead of exposing untouched destination pages. Patched commits are available in multiple stable kernel branches:

Workarounds

Restrict local access on s390 hosts to trusted administrators until patched kernels are deployed
Where feasible, migrate sensitive workloads off ESE-provisioned DASD volumes to fully allocated volumes
Enforce distribution vendor advisories from Red Hat, SUSE, and Canonical for backported fixes on enterprise s390 kernels