Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2026-89573

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against it…

Published Sep 11, 2026EPSS 0.13%

Overview

CVE-2026-89573 is a high-severity vulnerability. It was published on September 11, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm array: reject an array block whose value size is not the caller's

array_block_check() can only compare the header against itself, so a block

with value_size 4 and max_entries 1018 is internally consistent and passes.

dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the

roots for both live in the superblock. Point the mappings root at a hint

block and __load_mappings() walks it through an info whose value size is 8,

so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160

of a 4096-byte block.

get_ablock() and __shadow_ablock() are the two places that hold the block

and the caller at once. Reject there when the two value sizes disagree.

Arrays only ever read their own blocks, so this fires on crafted metadata

only.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/35cd3b278448c79614f65ab6bbc9ed348d847df9Refgit.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547Refgit.kernel.org/stable/c/522fa26da24ccaa298ebe3c1c97395d2d63dfc21Refgit.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168cRefgit.kernel.org/stable/c/a530a9a419a7c5fdb7dae55ffa2dd7a130631842Refgit.kernel.org/stable/c/a8237cb8fa0a628d903e76635bfdeae4202036b9Refgit.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573aRefgit.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2

How CyberStrike helps

Frequently asked questions

What is CVE-2026-89573?

CVE-2026-89573 is a high-severity vulnerability. It was published on September 11, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89573?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-89573?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-89573?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-89573 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Watch the demo →