CVE-2026-89574: Linux Kernel dm-array Privilege Escalation

CVE-2026-89574 Overview

CVE-2026-89574 is a Linux kernel vulnerability in the device-mapper (dm) array subsystem. The flaw resides in array_block_check(), which validates only blocknr and checksum fields while leaving structural header fields unchecked. An attacker with local privileges who can supply crafted dm-array metadata can trigger an out-of-bounds read that walks past a dm-bufio buffer during cache activation via dm_cache_load_mappings(). The vulnerability affects confidentiality, integrity, and availability of the host system. Kernel maintainers resolved the issue by adding self-consistent header validation in the array block read path.

Critical Impact
A local, low-privileged attacker supplying malicious dm-array metadata can cause kernel memory corruption or information disclosure by driving reads beyond a dm-bufio buffer during cache load.

Affected Products

Linux kernel (device-mapper dm-array subsystem)
Linux kernel builds using dm-cache with persistent metadata
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89574 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89574

Vulnerability Analysis

The vulnerability affects the device-mapper array data structure used by dm-cache to persist block mappings. The read-path validator array_block_check() only confirms the on-disk block number and checksum. It does not bound the structural fields that describe how many entries the block contains or how large those entries are.

Downstream code trusts these header fields. dm_array_cursor_next() uses the on-disk nr_entries value as its loop bound, and element_at() performs unguarded pointer arithmetic using value_size and the entry index. When the recorded entry count exceeds what the block can physically hold, the cursor stays anchored to one block while the index advances past its boundary. This produces an out-of-bounds read across the dm-bufio buffer.

The defective path is reached through dm_cache_load_mappings(), which iterates once per cache block during activation. This makes the flaw reliably triggerable whenever a crafted metadata device is attached.

Root Cause

The root cause is missing input validation [Improper Input Validation] on persisted metadata. array_block_check() never cross-checks value_size, max_entries, and nr_entries against block geometry. A zero value_size, a mismatched max_entries, or an oversized nr_entries is accepted as valid, leading to Out-of-Bounds Read during traversal.

Attack Vector

Exploitation requires local access and the ability to present a crafted dm-cache metadata device to the kernel. The attack surface is reached during cache activation, when dm_cache_load_mappings() invokes the array cursor. No user interaction is required, and the impact spans confidentiality, integrity, and availability because the read walks kernel memory adjacent to the dm-bufio buffer.

No verified public exploit code is available. Refer to the upstream fixes for the authoritative technical details: Kernel Git Commit 2965787 and Kernel Git Commit 9808ddf.

Detection Methods for CVE-2026-89574

Indicators of Compromise

Kernel oops, warnings, or BUG_ON() traces originating in fill_ablock(), trim_ablock(), or dm_array_cursor_next().
Unexpected dm-cache activation failures or corruption warnings from dm-bufio during device assembly.
Presence of unauthorized dm-cache metadata devices attached by non-administrative workflows.

Detection Strategies

Monitor dmesg and journalctl -k for device-mapper stack traces referencing array_block_check, element_at, or dm_cache_load_mappings.
Audit kernel package versions against distribution advisories referencing the upstream fix commits.
Correlate storage subsystem crashes with recent dmsetup or lvm operations that loaded new metadata.

Monitoring Recommendations

Ingest kernel logs into a centralized logging pipeline and alert on device-mapper faults.
Track privileged use of dmsetup, cryptsetup, and lvm commands on production hosts.
Alert on unexpected loopback or block device attachments that could deliver crafted metadata.

How to Mitigate CVE-2026-89574

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream dm array: validate array block headers on read fix.
Restrict access to block device creation and dmsetup operations to trusted administrators only.
Inventory systems using dm-cache and prioritize patching hosts that mount untrusted or removable storage.

Patch Information

Upstream Linux kernel maintainers resolved CVE-2026-89574 by strengthening array_block_check() to reject a zero value_size, require max_entries to equal calc_max_entries() for the given value_size and block size, and require nr_entries to fit within max_entries. Equality rather than an upper bound is enforced because a count below real capacity triggers BUG_ON() in fill_ablock() and trim_ablock(). Fixes are available in the following stable commits: Kernel Git Commit 2965787, Kernel Git Commit 67adda7, Kernel Git Commit 9808ddf, and Kernel Git Commit b33f76d.

Workarounds

Avoid activating dm-cache volumes sourced from untrusted metadata until the patched kernel is deployed.
Enforce strict permissions on /dev/mapper control interfaces and require elevated privileges for volume operations.
Disable automatic assembly of unknown device-mapper stacks on multi-tenant or shared systems.

bash

# Verify running kernel version and confirm the fix is present
uname -r
# Debian/Ubuntu: update to a patched kernel
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
# RHEL/Rocky/AlmaLinux
sudo dnf update kernel
# Restrict dmsetup to root-only invocation
sudo chmod 700 /usr/sbin/dmsetup