ZeroHour

CVE-2026-89456

niche

Partial-completion loss in Linux s390 DASD ERP recovery silently zeroes read data

CVSS 3.1
7.0 high
EPSS
Published
()
Modified
AI analysis

The Linux kernel's s390 DASD driver fails to copy the partial-completion byte count (proc_bytes) from a completed error-recovery (ERP) request back to the original I/O request. When a read of an ESE (thin-provisioned) DASD track is partially completed — for example, a read of a not-yet-allocated track that returns fewer bytes than requested — and then goes through ERP recovery, the remainder is silently dropped: __dasd_cleanup_cqr() sees proc_bytes == 0 and completes the whole request instead of requeueing the unread portion. The result is that applications receive zeroed data for the part that was never read, with no error signaled — a silent data-corruption (integrity) flaw. This affects Linux on IBM Z (s390x) systems using DASD storage, particularly ESE thin-provisioned volumes that experience I/O errors during reads. CVSS 3.1 is 7.0 (local vector, high attack complexity, low privileges, high C/I/A impact), and no public PoC or known exploitation exists; this is a correctness bug rather than a remotely exploitable flaw.

What to do: Apply a kernel release from your distribution that contains the upstream fix (commit 's390/dasd: Propagate partial completion length across ERP recovery') and reboot affected LPARs/VMs to load the patched kernel. Until patched, treat reads from ESE/thin-provisioned DASD volumes as potentially silently zero-filled if the underlying I/O experienced errors — verify critical datasets against backups or checksums. Watch kernel logs for DASD ERP recovery events on ESE devices to identify which volumes may have returned corrupted reads.

Affected
Linux (kernel.org) Linux kernel, s390/dasd device driver (DASD, including ESE thin-provisioned devices)
Estimated exposure
nicheOn the order of low thousands of IBM Z hosts — only s390x Linux systems using ESE/thin-provisioned DASD that hit error-recovery paths are actually at risk — s390x is a mainframe-only architecture with a comparatively small global install base, and the bug only triggers on DASD error recovery for ESE devices, so the truly affected population is the subset of IBM Z Linux deployments using…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.

Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

In the news

No ingested article mentions this CVE yet.