CVE-2026-89575

A flaw was found in the Linux kernel's device mapper (dm-raid1) component. This vulnerability occurs in the build_constructor_string() function, where insufficient space is reserved for a NUL-terminator when formatting a string with sprintf(). This oversight can lead to a buffer overflow, potentially allowing an attacker to cause a denial of service or execute arbitrary code.

A one byte NUL heap overflow can occur in dm raid1 userspace log construction because build_constructor_string() reserves space for the maximum 20 decimal digits of a long long value but does not reserve space for the terminating NUL written by sprintf(). A local actor able to create or reload the affected Device Mapper raid1 target can trigger an out of bounds write in kernel memory when the formatted value reaches the maximum digit length. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate storage mapping control to a reduced capability root, container root, or storage management service account rather than a full host administrator. The issue is not network reachable and is triggered through local Device Mapper control plane operations. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel heap memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.