{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "6513c29f44f2cc970c0e9fecfe5a6526c3e73025"
            },
            {
              "fixed": "67adda7ed5da3e3b64f5b9021a02c21fb374fd9c"
            },
            {
              "fixed": "b33f76d33aaeacf3baf3370d8d64985169b36600"
            },
            {
              "fixed": "9808ddffb4bc659352df3020cd84d9d864820ee5"
            },
            {
              "fixed": "2965787723084835b18dfe993cd450ebf5bd4540"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89574.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: validate array block headers on read\n\narray_block_check() validates blocknr and csum and nothing else, while\nnode_check(), next to it, has bounded the structural fields since both\nwere written. dm_array_cursor_next() takes its loop bound from the\non-disk nr_entries and element_at() is unguarded pointer arithmetic, so\na count larger than the block holds keeps the cursor in one block while\nthe index grows past it and the read walks off the dm-bufio buffer --\ndm_cache_load_mappings() drives it once per cache block at activation.\n\nCheck the header against itself: reject a zero value_size, require\nmax_entries to equal calc_max_entries() for that value_size and block\nsize, and require nr_entries to fit. Equality rather than an upper bound,\nsince a count below the real capacity trips BUG_ON() in fill_ablock() and\ntrim_ablock(). Metadata dm-array writes satisfies all three.",
  "id": "CVE-2026-89574",
  "modified": "2026-09-13T03:30:29.266240338Z",
  "published": "2026-09-11T19:44:42.494Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2965787723084835b18dfe993cd450ebf5bd4540"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/67adda7ed5da3e3b64f5b9021a02c21fb374fd9c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9808ddffb4bc659352df3020cd84d9d864820ee5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b33f76d33aaeacf3baf3370d8d64985169b36600"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89574.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89574"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "dm array: validate array block headers on read"
}