CVE-2026-89456 (GCVE-0-2026-89456)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: 5e6bdd37c5526ef01326df5dabb93011ee89237e
Version: fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04
Version: 5f7c9989f11305aaa43e0f4378f4f070022a9f2b
Version: 5.4.26   ≤
Version: 5.5.10   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/block/dasd_erp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e063165d3fe58db2a517717b830f17e82d03467",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "6b0954c8a259da1e4aa745989f82723947acfb46",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "f735b9710f0c8fe72c1060103e865f4ae678190b",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "d6b8778b1b82aa3a8dbf8612080f635b834bd16b",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "ceafb262475ac6cb3a7d07b1102608be2b216b99",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "15ec03452c18e8d288e519837d21b308300d74b2",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "lessThan": "6fb5ba2e7e43173a3761e46f091070a8185efa14",
              "status": "affected",
              "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5f7c9989f11305aaa43e0f4378f4f070022a9f2b",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.26",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/block/dasd_erp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the s390 DASD block driver\u0027s ERP postaction and is reached only by local block I/O to an ESE (thin-provisioned) volume, via a DASD-backed filesystem or /dev/dasd*; no ksmbd, nfsd, or packet path parses attacker data into this code.\nAC:H - Exploitation needs an ESE NRF partial read whose CQR is an ERP retry, so a prior hardware-reported unit check or similar recoverable error must occur; the attacker cannot inject sense data or craft CCWs, which the driver builds itself.\nPR:L - Unprivileged local users trigger the path through ordinary read/write syscalls on files stored on a DASD-backed filesystem; dasd_open and do_dasd_request impose no capability check on that I/O path.\nUI:N - The attacker performs the I/O themselves; no second user must mount a volume, open a file, or otherwise interact.\nS:U - Incorrect request completion affects host kernel block I/O and page-cache contents on the same LPAR; it is not a KVM/vfio-ccw guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Dropping proc_bytes completes the unread remainder as success, so page-cache pages the driver never filled \u2014 stale previously freed kernel or other tenants\u0027 memory \u2014 are marked uptodate and returned to userspace as valid file data.\nI:H - Tracks after the unallocated ESE hole are never fetched yet the whole request succeeds, substituting zeros or stale bytes for real disk contents that filesystems may write back, permanently corrupting co-resident file data and metadata.\nA:H - Successful completion of filesystem, journal, or executable reads with zeros or stale data can corrupt metadata parsers and trigger ext4 errors=panic or XFS forced shutdown, taking IBM Z/LinuxONE storage nodes down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:47:05.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e063165d3fe58db2a517717b830f17e82d03467"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b0954c8a259da1e4aa745989f82723947acfb46"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f735b9710f0c8fe72c1060103e865f4ae678190b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99"
        },
        {
          "url": "https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14"
        }
      ],
      "title": "s390/dasd: Propagate partial completion length across ERP recovery",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89456",
    "datePublished": "2026-09-11T19:43:20.037Z",
    "dateReserved": "2026-09-11T19:38:34.707Z",
    "dateUpdated": "2026-10-19T08:47:05.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.