CVE-2026-89456
nichePartial-completion loss in Linux s390 DASD ERP recovery silently zeroes read data
The Linux kernel's s390 DASD driver fails to copy the partial-completion byte count (proc_bytes) from a completed error-recovery (ERP) request back to the original I/O request. When a read of an ESE (thin-provisioned) DASD track is partially completed — for example, a read of a not-yet-allocated track that returns fewer bytes than requested — and then goes through ERP recovery, the remainder is silently dropped: __dasd_cleanup_cqr() sees proc_bytes == 0 and completes the whole request instead of requeueing the unread portion. The result is that applications receive zeroed data for the part that was never read, with no error signaled — a silent data-corruption (integrity) flaw. This affects Linux on IBM Z (s390x) systems using DASD storage, particularly ESE thin-provisioned volumes that experience I/O errors during reads. CVSS 3.1 is 7.0 (local vector, high attack complexity, low privileges, high C/I/A impact), and no public PoC or known exploitation exists; this is a correctness bug rather than a remotely exploitable flaw.
What to do: Apply a kernel release from your distribution that contains the upstream fix (commit 's390/dasd: Propagate partial completion length across ERP recovery') and reboot affected LPARs/VMs to load the patched kernel. Until patched, treat reads from ESE/thin-provisioned DASD volumes as potentially silently zero-filled if the underlying I/O experienced errors — verify critical datasets against backups or checksums. Watch kernel logs for DASD ERP recovery events on ESE devices to identify which volumes may have returned corrupted reads.
| Linux (kernel.org) Linux kernel, s390/dasd device driver (DASD, including ESE thin-provisioned devices) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.