CVE-2026-89584

A flaw was found in the Linux kernel's block layer. This vulnerability arises from insufficient validation of user-space data structures (vectors) against the device's Direct Memory Access (DMA) alignment requirements. A local attacker could exploit this by providing misaligned data, causing the system to reject the input with an error and potentially leading to a Denial of Service (DoS).

Block direct I/O could build bios from userspace vectors that do not satisfy the target device DMA alignment. Some bio based or stacking drivers may not reject this after submission, so a local caller can reach lower block layers with sub aligned buffer offsets or lengths and cause I/O failure, data corruption, or a kernel availability problem on affected storage stacks. For the CVSS the PR:L is used because triggering requires a local process with permission to issue direct I/O or io_uring I/O to an accessible block device or file, but it does not require full administrator privileges in all deployments. The issue is not network reachable. Impact is mainly local denial of service or storage integrity risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.