CVE-2026-89574

A flaw was found in the Linux kernel's device mapper (dm) array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk nr_entries value. This can lead to an out-of-bounds read from the dm-bufio buffer, potentially resulting in memory corruption or information disclosure.

A moderate-impact flaw was found in the Linux kernel's device-mapper array (dm-array) metadata handling, affecting the kernel shipped in Red Hat Enterprise Linux (kernel and kernel-rt) and the RHCOS kernels used by OpenShift Container Platform. array_block_check() validated only the block number and checksum of an array block header, so a crafted on-disk nr_entries value larger than the block can actually hold was accepted. dm_array_cursor_next() uses that on-disk count as its loop bound and element_at() performs unguarded pointer arithmetic, so iterating the array reads past the end of the dm-bufio buffer; dm_cache_load_mappings() drives this iteration once per cache block when a dm-cache device is activated. A local attacker who can control the on-disk dm-array metadata of a block device that is later activated as a dm-cache target can therefore trigger an out-of-bounds read, which can crash the kernel (denial of service) and may disclose kernel memory contents. Red Hat assessed this flaw as moderate severity with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting an out-of-bounds read with availability impact; the upstream CVE record scores it 7.8 with high confidentiality and integrity impacts, which the verified read-only nature of this flaw does not support. Affected Red Hat Enterprise Linux and OpenShift Container Platform (RHCOS) streams are currently set to DEFER because the impact is moderate with a CVSS below 7.0 and no trackers are filed for moderate-severity flaws without high CVSS, so no fix is currently scheduled. The residual risk of deferring is that a local attacker who can plant crafted dm-array metadata and have it activated can still cause a kernel crash or an out-of-bounds memory read on the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.