{"id":21496,"date":"2026-09-12T04:31:15","date_gmt":"2026-09-11T20:31:15","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89574"},"modified":"2026-09-12T04:31:15","modified_gmt":"2026-09-11T20:31:15","slug":"cve-2026-89574","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89574","title":{"rendered":"CVE-2026-89574 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: validate ar"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>dm array: validate array block headers on read<\/p>\n<p>array_block_check() validates blocknr and csum and nothing else, while<br \/>\nnode_check(), next to it, has bounded the structural fields since both<br \/>\nwere written. dm_array_cursor_next() takes its loop bound from the<br \/>\non-disk nr_entries and element_at() is unguarded pointer arithmetic, so<br \/>\na count larger than the block holds keeps the cursor in one block while<br \/>\nthe index grows past it and the read walks off the dm-bufio buffer &#8212;<br \/>\ndm_cache_load_mappings() drives it once per cache block at activation.<\/p>\n<p>Check the header against itself: reject a zero value_size, require<br \/>\nmax_entries to equal calc_max_entries() for that value_size and block<br \/>\nsize, and require nr_entries to fit. Equality rather than an upper bound,<br \/>\nsince a count below the real capacity trips BUG_ON() in fill_ablock() and<br \/>\ntrim_ablock(). Metadata dm-array writes satisfies all three.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>dm array: validate array block headers on read<\/p>\n<p>array_block_check() validates blocknr and csum and nothing else, while<br \/>\nnode_check()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21496","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}