CVE-2026-89559

A flaw was found in the Linux kernel's libnvdimm/labels component. An integer overflow vulnerability exists in the __nd_label_validate() function, where a 32-bit calculation of a namespace index field (nslot) can wrap around. This allows a local attacker, or an attacker with control over the storage medium, to provide a specially crafted nslot value. This crafted value can bypass security checks, leading to an out-of-bounds write and potential memory corruption.

An integer overflow in libnvdimm label validation can allow a crafted namespace index nslot value to pass the config area bounds check. The overflow happens before comparing nslot multiplied by the runtime namespace label size against the NVDIMM config size, so a very large on media or userspace supplied value can wrap to a small value and be accepted. The accepted nslot is later used as a loop count in label data initialization, where memset can write past the end of the config buffer. For the CVSS the PR:L is used for the paranoid score because a local process with delegated access to the nvdimm config interface or device permissions may be able to provide crafted label data without full host administrator control. The issue is not network reachable. Impact is kernel memory corruption with at least denial of service and a plausible path to confidentiality and integrity impact, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.