CVE-2026-89577 Overview
CVE-2026-89577 affects the Linux kernel device-mapper subsystem, specifically the dm-io interface and dm-raid1 target. The kernel treats non-retryable block-layer errors (BLK_STS_NOTSUPP and BLK_STS_INVAL) the same as recoverable I/O errors. This causes dm-raid1 to mark a mirror leg as failed when the underlying device simply cannot service a specific unsupported or invalid bio.
The issue manifests when a user submits unaligned bio vectors to a dm-raid1 device. Instead of returning the error to the caller, the mirror target erroneously fails a healthy leg, degrading the RAID1 array.
Critical Impact
Unaligned bio vectors submitted to dm-raid1 can trigger spurious mirror leg failures, degrading RAID1 arrays and reducing data redundancy without an underlying hardware fault.
Affected Products
- Linux kernel device-mapper (dm-io) subsystem
- Linux kernel dm-raid1 mirror target
- Linux stable kernel branches referenced by commits 15fc1ec, 47a5e62, and 49694a3
Discovery Timeline
- 2026-09-11 - CVE-2026-89577 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89577
Vulnerability Analysis
The device-mapper I/O layer (dm-io) originally reported all completion errors through a single bitmap. The dm-raid1 target consumed this bitmap and treated every set bit as evidence that the corresponding mirror leg had failed. This conflates two distinct classes of block-layer status codes.
BLK_STS_NOTSUPP indicates the underlying device does not support the requested operation. BLK_STS_INVAL indicates the bio itself was malformed, such as containing unaligned vectors. Neither status implies the device is unhealthy, and neither should trigger mirror leg replacement or resynchronization.
The fix modifies dm-io to return two separate bitmaps: error_bits for retryable or genuine I/O errors, and unsup_bits for BLK_STS_NOTSUPP and BLK_STS_INVAL. dm-raid1 is updated to ignore bits set only in unsup_bits when deciding whether to fail a leg. This vulnerability is a logic flaw in error classification, related to improper input validation and error handling in kernel storage code.
Root Cause
The root cause is undifferentiated error propagation between dm-io and its consumers. Non-retryable status codes such as BLK_STS_NOTSUPP and BLK_STS_INVAL were reported through the same channel used for recoverable I/O failures. dm-raid1 had no way to distinguish an unsupported request from a hardware fault.
Attack Vector
A local user or workload issuing bios with unaligned vectors to a dm-raid1 device can trigger the misbehavior. There is no evidence of remote exploitation, and no exploit is publicly available. The primary risk is data-availability degradation rather than code execution. Refer to the Kernel Git Commit 15fc1ec, Kernel Git Commit 47a5e62, and Kernel Git Commit 49694a3 for the upstream fix. Companion commit 62dc37a819a5 completes the correction alongside the referenced patches.
Detection Methods for CVE-2026-89577
Indicators of Compromise
- Unexpected dm-raid1 leg failures logged in dmesg or journalctl without corresponding SCSI, NVMe, or block-device hardware errors.
- Kernel messages referencing mirror leg removal shortly after workloads that submit unaligned or unusual bio vectors.
- RAID1 arrays entering degraded state on hosts running affected kernel versions with no underlying disk faults reported by SMART or vendor tooling.
Detection Strategies
- Correlate dm-raid1 degradation events with the running kernel version to identify hosts on unpatched builds.
- Audit workloads (databases, container storage drivers, custom block clients) that may issue unaligned bios to mirrored volumes.
- Review kernel change logs and package metadata to confirm whether commits 15fc1ec, 47a5e62, and 49694a3 are applied.
Monitoring Recommendations
- Alert on any transition of dm-raid1 arrays to a degraded state and require verification against physical device health telemetry.
- Forward kernel and device-mapper logs to a centralized data lake for correlation across the fleet.
- Track kernel patch levels as part of standard vulnerability management to detect drift on storage-critical hosts.
How to Mitigate CVE-2026-89577
Immediate Actions Required
- Inventory Linux hosts using dm-raid1 mirrors and identify kernel versions lacking the referenced upstream commits.
- Prioritize patching of storage servers, hypervisors, and container hosts that rely on device-mapper RAID1 for redundancy.
- Validate distribution vendor advisories for backported fixes and schedule reboots into the affected fleet.
Patch Information
Apply the upstream Linux kernel fixes from Kernel Git Commit 15fc1ec, Kernel Git Commit 47a5e62, and Kernel Git Commit 49694a3. These changes introduce the unsup_bits bitmap in dm-io and update dm-raid1 to ignore non-retryable errors. The complete fix also requires companion commit 62dc37a819a5. Consume the fixes through your Linux distribution's stable kernel updates.
Workarounds
- Where feasible, avoid workloads that submit unaligned bio vectors to dm-raid1 devices until the kernel is patched.
- Consider alternative RAID implementations (for example, md RAID or hardware RAID) for critical mirrored volumes on unpatched hosts.
- Monitor mirror health closely and re-add legs manually when spurious failures occur, pending kernel updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.