CVE-2026-89557

The Linux kernel's md (software RAID) driver fails to validate sb->bblog_shift, an 8-bit field read from an on-disk RAID superblock (version 1.x) in super_1_load(). An attacker with local access and write permission to a block device can plant a crafted superblock whose shift value causes a 64-bit sector calculation to overflow, which in turn triggers an overflow inside the kernel badblocks handling code (_badblocks_clear() in block/badblocks.c). Successful exploitation of this memory corruption could allow privilege escalation or a kernel crash, consistent with the CVSS 7.8 rating (local vector, low privileges required). Any Linux system that assembles md RAID arrays with superblock version 1 from disks an attacker could have written to is potentially affected. No public proof of concept is known and the flaw is not listed in the CISA KEV catalog.

What to do: Apply distribution kernel updates that include the upstream fix adding the bblog_shift overflow check in super_1_load() and reboot into the patched kernel. Restrict write access to raw block devices and disk devices being added to md arrays, and treat second-hand or untrusted disks as hostile: inspect or wipe their superblocks (e.g., mdadm --zero-superblock) before assembly. Check whether hosts auto-assemble arrays at boot from removable or untrusted media, since that is the most realistic path to a malicious superblock being parsed.