CVE-2026-89578 Overview
CVE-2026-89578 is a Linux kernel vulnerability in the device-mapper I/O subsystem (dm-io). The flaw affects the do_region() function when processing DM_IO_BIO requests against dm-mirror targets. When a source bio contains byte-granular vector lengths that are not sector aligned, sector-based accounting in the destination bio construction loses a sub-sector fragment. The to_sector() helper truncates the remainder, causing the outer loop to spin forever submitting empty bios and hanging the I/O path. Misaligned O_DIRECT buffers split across pages are the primary trigger. The issue has been resolved upstream by cloning the source biovec with bio_alloc_clone() rather than rebuilding it page by page.
Critical Impact
Local processes issuing misaligned direct I/O to a dm-mirror device can hang kernel I/O submission, producing a denial-of-service condition on the affected block device.
Affected Products
- Linux kernel dm-io subsystem (device-mapper)
- Linux systems using dm-mirror targets with direct I/O workloads
- Distributions shipping affected upstream kernel versions prior to the fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89578 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89578
Vulnerability Analysis
The vulnerability resides in do_region() within the device-mapper I/O layer. For DM_IO_BIO requests, the function built each destination bio by walking the source bio's biovec and re-adding pages one at a time. It tracked remaining transfer size in sectors rather than bytes. Because biovec entries are byte granular, a vector length that is not a multiple of the sector size causes accounting to drift. The to_sector() conversion truncates the sub-sector remainder to zero, so the outer loop never makes forward progress. It repeatedly submits empty bios, resulting in an infinite loop inside kernel context and stalling the I/O queue for the target dm-mirror device.
Root Cause
The root cause is a numeric truncation defect in the loop's termination logic. Sector-granular accounting cannot represent byte-granular biovec lengths that arise from misaligned O_DIRECT buffers split across pages. When a fragment smaller than one sector remains, to_sector() returns zero and the constructed bio carries no payload, but the outer loop treats the region as incomplete and iterates again with identical state.
Attack Vector
The condition is triggered locally by any process that issues a misaligned direct I/O request against a dm-mirror device. No special privileges are required beyond the ability to open the block device with O_DIRECT and submit a buffer whose alignment causes a sub-sector split. The result is a hang of the affected I/O path, denying service to workloads dependent on that device. The vulnerability is not reachable remotely and does not appear to enable memory corruption or privilege escalation.
No verified exploit code is publicly available. Refer to the upstream fix commits for the exact code path: Kernel Git Commit 62dc37a, Kernel Git Commit 8dc48b6, and Kernel Git Commit 9493ac6.
Detection Methods for CVE-2026-89578
Indicators of Compromise
- Kernel task hangs with stack traces showing do_region, dispatch_io, or dm_io frames blocked indefinitely.
- hung_task warnings referencing processes performing direct I/O against a device-mapper mirror target.
- I/O queue depth on the affected dm-mirror device growing without completion events in iostat output.
Detection Strategies
- Correlate dmesg output for repeated INFO: task ... blocked for more than N seconds entries tied to dm-mirror devices.
- Monitor kernel BPF or ftrace probes on submit_bio and do_region to identify zero-length bio submissions in tight loops.
- Inventory running kernels against the fixed commits and flag hosts running unpatched versions that also expose dm-mirror configurations.
Monitoring Recommendations
- Enable hung_task_panic or elevated hung_task_timeout_secs alerting in production kernels to surface I/O stalls quickly.
- Track block layer metrics for stalled request queues on device-mapper devices using node-level exporters.
- Log and alert on unexpected reboots or watchdog resets of hosts running dm-mirror workloads with direct I/O consumers such as databases.
How to Mitigate CVE-2026-89578
Immediate Actions Required
- Apply the upstream kernel patches referenced in the fix commits and rebuild or update to a distribution kernel that includes them.
- Identify hosts that combine dm-mirror targets with workloads issuing O_DIRECT I/O and prioritize those for patching.
- Schedule reboots into the patched kernel; the fix is in-kernel and cannot be applied through userspace configuration.
Patch Information
The fix replaces the per-page biovec rebuild with a call to bio_alloc_clone(), which clones the source biovec and remaps it to the target device. The cloned bio inherits the source iterator and alignment, and the block layer splits it to the target's limits on submission. The page-list, vma, and kmem source paths retain the existing copy logic. Fix commits are available at Kernel Git Commit 62dc37a, Kernel Git Commit 8dc48b6, and Kernel Git Commit 9493ac6.
Workarounds
- Avoid dm-mirror targets for workloads that issue misaligned O_DIRECT writes until the kernel is patched; use alternative device-mapper targets where feasible.
- Constrain application I/O paths to sector-aligned buffers, for example by aligning allocations to the logical block size reported by the target device.
- Where patching is not immediately possible, restrict local user access to block devices exposing dm-mirror targets to reduce trigger surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
