CVE-2026-89456

A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, an issue exists during error recovery for disk read operations. When a request is partially completed and then recovered, the system fails to correctly propagate the length of the processed data. This can lead to the kernel silently returning zeroed data for the unread portion of a request, potentially resulting in information disclosure to a local attacker.

A partial completion handling bug in s390/DASD ERP recovery can lose the proc_bytes value when an ERP request is copied back to the original request. If an ESE read of a not yet allocated track completes only part of the requested range and then goes through ERP recovery, __dasd_cleanup_cqr may see proc_bytes as 0 and complete the full request instead of requeuing the unread remainder. This can silently return zero filled data for bytes that were never actually read, causing storage data integrity impact rather than memory corruption. For the CVSS the PR:L is used because a local user or process able to issue reads through an affected filesystem or block device may trigger the faulty I/O path, although reliable reproduction depends on s390 DASD thin provisioned ESE storage and ERP recovery conditions. The issue is not network reachable. Impact is silent data corruption with possible availability effects if applications consume corrupted reads or fail on inconsistent data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.