CVE-2026-89557

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: do overflow check for sb->bblog_shift in super_1_load()

In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-

disk superblock. It is used for badblocks API badblocks_set() by the

following sequence,

1930 rdev->badblocks.shift = sb->bblog_shift;

1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {

1932 u64 bb = le64_to_cpu(*bbp);

1933 int count = bb & (0x3ff);

1934 u64 sector = bb >> 10;

1935 sector <<= sb->bblog_shift;

1936 count <<= sb->bblog_shift;

1937 if (bb + 1 == 0)

1938 break;

1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))

1940 return -EINVAL;

1941 }

bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for

an invalid bb->bblog_shit, it is possible to make sector be overflowed

by the following calculation,

1935 sector <<

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References