CVE-2026-89573 Overview
CVE-2026-89573 is a Linux kernel vulnerability in the device-mapper (dm) array subsystem. The flaw resides in array_block_check(), which validates array block headers only against themselves. Crafted metadata can point a mappings root at a hint block, causing __load_mappings() to stride 8 bytes across 4-byte entries. This out-of-bounds read reaches offset 8160 of a 4096-byte block, corrupting dm-cache operations. The bug affects get_ablock() and __shadow_ablock(), the two call sites that hold both the block and the caller context. The fix rejects array blocks whose value size does not match the caller's expected size.
Critical Impact
A local attacker with permission to attach crafted dm-cache metadata can trigger out-of-bounds memory access in the kernel, leading to information disclosure, memory corruption, or privilege escalation.
Affected Products
- Linux Kernel — device-mapper array subsystem (dm array)
- Linux Kernel — dm-cache target consuming mappings and hints arrays
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89573 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89573
Vulnerability Analysis
The Linux kernel device-mapper array data structure stores fixed-size values in on-disk blocks. Each block carries a header describing value_size and max_entries. The validator array_block_check() only cross-checks the header's fields against each other. A block with value_size = 4 and max_entries = 1018 is internally consistent and passes validation regardless of how the caller intends to use it.
dm-cache maintains two arrays whose roots live in the superblock: a mappings array with 8-byte entries and a hints array with 4-byte entries. An attacker who supplies crafted metadata can swap these roots so the mappings root references a hint block. When __load_mappings() walks the block through an info struct configured for 8-byte values, element_at() computes offsets by striding 8 bytes across records that are only 4 bytes wide. The walk reaches offset 8160 inside a 4096-byte block, producing an out-of-bounds read [CWE-125] and undefined dm-cache behavior.
Root Cause
The root cause is missing validation that an array block's declared value_size matches the caller's expected value size. Header self-consistency is insufficient because two arrays sharing a metadata device can legitimately have different value sizes. The fix adds explicit checks in get_ablock() and __shadow_ablock(), the two functions that simultaneously hold the block and the caller context, rejecting any block whose value size disagrees with the caller.
Attack Vector
Exploitation requires local access with privileges sufficient to present a crafted dm-cache metadata device to the kernel. Arrays only ever read their own blocks under normal operation, so the vulnerability triggers only against attacker-supplied metadata. Successful exploitation can produce kernel memory disclosure, corruption of adjacent dm-cache state, or a path to privilege escalation.
See the upstream fix commits including Kernel Git Commit 35cd3b2 and Kernel Git Commit 522fa26 for technical details.
Detection Methods for CVE-2026-89573
Indicators of Compromise
- Kernel log entries from dm-array or dm-cache reporting rejected blocks after patch installation, indicating attempted use of crafted metadata
- Unexpected dmsetup or cache_check failures on volumes whose provenance is unknown
- KASAN or slab corruption reports referencing element_at, get_ablock, or __load_mappings
Detection Strategies
- Audit kernel versions against the fix commits and flag hosts running vulnerable stable branches without the backported patch
- Monitor for privileged process invocations of dmsetup create, dmsetup load, or direct writes to /dev/mapper/control from non-administrative contexts
- Correlate loop-device or block-device attachments with subsequent dm-cache activation to identify anomalous metadata sources
Monitoring Recommendations
- Forward kern.log and journald kernel facility events to a centralized data lake for retrospective analysis
- Alert on new mounts of user-supplied disk images followed by device-mapper table loads
- Track loaded kernel modules to detect unexpected dm_cache or dm_persistent_data loads on hosts that do not use these features
How to Mitigate CVE-2026-89573
Immediate Actions Required
- Apply the upstream stable kernel updates that include the referenced fix commits and reboot affected hosts
- Restrict CAP_SYS_ADMIN and access to /dev/mapper/control to trusted administrators only
- Prohibit mounting or activating dm-cache metadata sourced from untrusted disk images, USB media, or shared storage
Patch Information
The fix rejects array blocks with mismatched value sizes in get_ablock() and __shadow_ablock(). Backports are available across stable branches in the following commits: 35cd3b2, 4538a28, 522fa26, 7bf4b5c, a530a9a, a8237cb, ac4a5eb, and cb409b38. Consult your distribution's advisories for backported package versions.
Workarounds
- Disable or unload the dm_cache and dm_persistent_data kernel modules on hosts that do not require dm-cache functionality
- Enforce strict mount policies that block automatic activation of dm-cache metadata from removable or untrusted media
- Constrain container and virtualization workloads so tenants cannot present arbitrary block devices to the host kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
