{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89456","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.707Z","datePublished":"2026-09-11T19:43:20.037Z","dateUpdated":"2026-09-14T11:59:56.742Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-14T11:59:56.742Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the s390 DASD block driver's ERP postaction and is reached only by local block I/O to an ESE (thin-provisioned) volume, via a DASD-backed filesystem or /dev/dasd*; no ksmbd, nfsd, or packet path parses attacker data into this code.\nAC:H - Exploitation needs an ESE NRF partial read whose CQR is an ERP retry, so a prior hardware-reported unit check or similar recoverable error must occur; the attacker cannot inject sense data or craft CCWs, which the driver builds itself.\nPR:L - Unprivileged local users trigger the path through ordinary read/write syscalls on files stored on a DASD-backed filesystem; dasd_open and do_dasd_request impose no capability check on that I/O path.\nUI:N - The attacker performs the I/O themselves; no second user must mount a volume, open a file, or otherwise interact.\nS:U - Incorrect request completion affects host kernel block I/O and page-cache contents on the same LPAR; it is not a KVM/vfio-ccw guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Dropping proc_bytes completes the unread remainder as success, so page-cache pages the driver never filled — stale previously freed kernel or other tenants' memory — are marked uptodate and returned to userspace as valid file data.\nI:H - Tracks after the unallocated ESE hole are never fetched yet the whole request succeeds, substituting zeros or stale bytes for real disk contents that filesystems may write back, permanently corrupting co-resident file data and metadata.\nA:H - Successful completion of filesystem, journal, or executable reads with zeros or stale data can corrupt metadata parsers and trigger ext4 errors=panic or XFS forced shutdown, taking IBM Z/LinuxONE storage nodes down."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/block/dasd_erp.c"],"versions":[{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"9e063165d3fe58db2a517717b830f17e82d03467","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"6b0954c8a259da1e4aa745989f82723947acfb46","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"f735b9710f0c8fe72c1060103e865f4ae678190b","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"d6b8778b1b82aa3a8dbf8612080f635b834bd16b","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"ceafb262475ac6cb3a7d07b1102608be2b216b99","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"15ec03452c18e8d288e519837d21b308300d74b2","status":"affected","versionType":"git"},{"version":"5e6bdd37c5526ef01326df5dabb93011ee89237e","lessThan":"6fb5ba2e7e43173a3761e46f091070a8185efa14","status":"affected","versionType":"git"},{"version":"fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04","status":"affected","versionType":"git"},{"version":"5f7c9989f11305aaa43e0f4378f4f070022a9f2b","status":"affected","versionType":"git"},{"version":"5.4.26","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.5.10","lessThan":"5.6","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/block/dasd_erp.c"],"versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","status":"unaffected","versionType":"semver"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.3-rc1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.26"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9e063165d3fe58db2a517717b830f17e82d03467"},{"url":"https://git.kernel.org/stable/c/6b0954c8a259da1e4aa745989f82723947acfb46"},{"url":"https://git.kernel.org/stable/c/d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f"},{"url":"https://git.kernel.org/stable/c/f735b9710f0c8fe72c1060103e865f4ae678190b"},{"url":"https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"},{"url":"https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99"},{"url":"https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2"},{"url":"https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14"}],"title":"s390/dasd: Propagate partial completion length across ERP recovery","x_generator":{"engine":"bippy-1.2.0"}}}}