CVE-2026-89559

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

The on-media namespace index field nslot is a u32 read from the DIMM

label storage area. __nd_label_validate() bounds it against the config

area size, but sizeof_namespace_label() returns unsigned, so the product

nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before

the comparison. A crafted nslot passes the bound and is then used as the

loop trip count in nd_label_data_init(), whose memset() walks off the end

of the config_size buffer: an out-of-bounds write.

The field is not trusted -- it comes from the medium, or from userspace

via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound

check is exact; conforming labels are unaffected.

The check was safe when introduced by commit 4a826c83db4e ("libnvdimm:

namespace indices: read and validate"): it multiplied by sizeof(struct

nd_namespace_label), a size_t, so on a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References