CVE-2026-89573

A flaw was found in the Linux kernel's device mapper (dm) array component. A local attacker could exploit this vulnerability by providing specially crafted metadata. This crafted metadata causes the system to misinterpret the size of data blocks, leading to an out-of-bounds read. This memory corruption could result in system instability or a denial of service.

A flaw of moderate severity was found in the Linux kernel's device-mapper (dm) array metadata handling, as used by dm-cache. The array block validity check (array_block_check()) only compares a block's header against itself, so a metadata block whose value size disagrees with the value size expected by the caller is accepted as internally consistent. If the dm-cache mappings root in the superblock points at a hint array block holding 4-byte entries and is loaded through an info expecting 8-byte entries, element_at() strides 8 bytes over 4-byte entries and reads past the end of the 4096-byte block, causing an out-of-bounds read that can result in kernel memory corruption, system instability, or a denial of service. Exploitation requires a local attacker able to supply specially crafted device-mapper metadata; dm arrays only read their own blocks, so this is triggered only by crafted metadata rather than by normal operation. Red Hat rated this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the out-of-bounds access primarily affects availability; this differs from the upstream CVEORG score of 7.8, which assumes high confidentiality and integrity impacts that Red Hat's analysis does not support. Affected Red Hat Enterprise Linux kernel and kernel-rt streams and OpenShift Container Platform (RHCOS) releases are resolved as deferred: because the impact is MODERATE with a CVSS score below 7.0, the fix is deferred to a future scheduled update rather than addressed urgently, leaving a residual risk of local denial of service from crafted dm metadata.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.