CVE-2026-89574

The dm-array metadata structure in the Linux kernel, used by the dm-cache target, validated only the block number and checksum of on-disk array block headers, leaving structural fields (value_size, max_entries, nr_entries) unchecked on read. When a dm-cache target is activated, dm_cache_load_mappings() drives dm_array_cursor_next(), which uses the on-disk nr_entries as its loop bound while element_at() performs unguarded pointer arithmetic, so a crafted header with an inflated entry count keeps the cursor in one block while the index walks off the end of the dm-bufio buffer. A local attacker with the privileges needed to activate a device-mapper target backed by attacker-crafted metadata can therefore trigger an out-of-bounds read of kernel memory (potential information disclosure) and system instability, reflected in a CVSS 3.1 base score of 7.8 (local vector, low privileges). In principle all Linux systems running kernels without this fix are affected, though exploitation requires local access plus the ability to supply a malicious metadata block device, and a count below real capacity could also trip kernel BUG_ON() paths in fill_ablock()/trim_ablock(). No public proof of concept or in-the-wild exploitation is known.

What to do: Apply distribution kernel updates as soon as the dm-array header-validation fix is backported (no fixed version numbers were specified in the advisory). Until patched, restrict which users or services can create and activate device-mapper targets (CAP_SYS_ADMIN), and only activate dm-cache targets against metadata block devices or disk images from trusted sources. Investigate any kernel crash or BUG_ON during dm-cache activation on unpatched systems as a potential sign of malicious metadata.