CVE-2026-89557

A flaw was found in the Linux kernel's Multiple Device (md) driver. A local attacker with control over a malicious disk image could provide a specially crafted on-disk superblock with an invalid 'bblog_shift' value. This invalid value can lead to an integer overflow when processing bad block information, potentially causing a system crash or data corruption, resulting in a denial of service.

A flaw of MODERATE impact was found in the Linux kernel's Multiple Device (md) driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux, the kernels shipped in Red Hat OpenShift's Red Hat Enterprise Linux CoreOS (RHCOS) images, and Red Hat In-Vehicle OS. In super_1_load(), the bblog_shift value read from an on-disk software RAID superblock is not validated before it is used to shift bad-block sector and count values and to configure the badblocks API. A local attacker with the privileges needed to present or assemble a maliciously crafted disk image as an MD array could supply an out-of-range bblog_shift value, causing an integer overflow while bad-block information is processed, which can lead to a system crash or data corruption and result in a denial of service. Red Hat assessed this flaw as MODERATE with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream 7.8 (IMPORTANT) score, because exploitation requires local access and privileges sufficient to configure MD devices, and the impact is limited to availability. Because this is a MODERATE severity issue with a CVSS score below the threshold at which Red Hat files trackers for it, fixes for the affected Red Hat products have been deferred; the residual risk is a local denial of service by an attacker who is already able to control the contents of a storage device used to assemble an MD array.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.