CVE-2026-89575: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89575 Overview

CVE-2026-89575 is a buffer overflow vulnerability in the Linux kernel's device-mapper RAID1 (dm raid1) subsystem. The flaw resides in the build_constructor_string() function, which failed to reserve space for the NUL terminator when formatting long long integer values via sprintf(). A long long can require up to 20 decimal digits, and the buffer sizing did not account for the trailing null byte. This produces an off-by-one write past the allocated buffer boundary. The upstream fix reserves the additional byte for the NUL terminator to prevent the overflow.

Critical Impact
A one-byte heap buffer overflow in kernel memory that can lead to memory corruption within the device-mapper RAID1 target path.

Affected Products

Linux kernel — device-mapper RAID1 target (drivers/md/dm-raid1.c)
Distributions shipping affected upstream kernel versions prior to the patched stable releases
Systems using dm-mirror / dm raid1 volumes

Discovery Timeline

2026-09-11 - CVE-2026-89575 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89575

Vulnerability Analysis

The defect is a classic off-by-one buffer overflow [CWE-193 / CWE-120] in the build_constructor_string() helper used by the dm raid1 target. The function constructs an argument string that includes decimal representations of long long values via sprintf(). The prior implementation sized the destination buffer using only the maximum digit width (20 characters) without accounting for the NUL terminator that sprintf() always writes. When the numeric representation reaches its maximum width, sprintf() writes one byte beyond the intended allocation.

Because this code path executes in kernel context during device-mapper table construction, the resulting corruption occurs in kernel heap memory. The overflow is deterministic when input values reach the maximum digit count, making it reachable during table setup for RAID1 mirror devices.

Root Cause

The root cause is incorrect buffer size arithmetic. The allocation reserved space for 20 digits per long long value but omitted the additional byte required for the terminating NUL character that sprintf() appends. The fix adds the missing byte to the size calculation so the terminator fits within the allocation.

Attack Vector

Triggering the overflow requires the ability to construct or manipulate device-mapper RAID1 targets, an operation typically restricted to privileged users holding CAP_SYS_ADMIN. The vulnerability is therefore a local kernel-memory corruption issue rather than a remote code execution vector. Exploitation would depend on turning the single-byte out-of-bounds write into a usable primitive against adjacent kernel heap objects.

No public proof-of-concept exploit is available. See the upstream fix commits for the exact code change: Kernel Commit 01a0276706 and Kernel Commit 0a3657ebd6.

Detection Methods for CVE-2026-89575

Indicators of Compromise

Unexpected kernel warnings referencing dm-raid1 or build_constructor_string in dmesg
KASAN (Kernel Address Sanitizer) reports flagging slab-out-of-bounds writes originating in dm-raid1.c
Kernel panics or BUG: messages during creation or reload of RAID1 mirror targets via dmsetup

Detection Strategies

Inventory running kernel versions and compare against the fixed stable releases listed in the upstream commits
Monitor for use of dmsetup create or dmsetup reload invocations that configure mirror targets
Enable KASAN in test and pre-production kernels to surface out-of-bounds writes reachable through device-mapper code paths

Monitoring Recommendations

Forward kernel logs (/var/log/kern.log, journald) to a centralized logging platform and alert on dm-raid1 faults
Track privileged use of device-mapper ioctls and correlate with subsequent kernel warnings
Maintain audit rules on /dev/mapper/control access to identify uncommon administrative activity

How to Mitigate CVE-2026-89575

Immediate Actions Required

Upgrade to a Linux kernel version that includes the patch commits referenced in the NVD entry
Apply distribution vendor kernel updates as soon as they publish backports for their supported stable trees
Restrict CAP_SYS_ADMIN and device-mapper administrative access to trusted service accounts only

Patch Information

The fix reserves one additional byte in the destination buffer used by build_constructor_string() so the NUL terminator written by sprintf() no longer overflows the allocation. Patched commits are available in the upstream stable trees, including Kernel Commit 1fcc9f9f3, Kernel Commit 35ba81c93f, Kernel Commit 644140527a, Kernel Commit 73c37fe54c, Kernel Commit 7b035983b8, and Kernel Commit f79b53ca3a.

Workarounds

Avoid creating or reloading dm raid1 mirror targets on unpatched kernels where possible
Prefer alternate RAID configurations (for example, dm raid with md-based personalities) until the patched kernel is deployed
Enforce least privilege so that only trusted administrators can invoke device-mapper table operations

bash

# Verify running kernel and check for dm-raid1 usage
uname -r
lsmod | grep -E 'dm_mirror|dm_raid'
dmsetup table | grep -i mirror