CVE-2026-89584

The Linux kernel's block layer fails to validate user-space I/O vectors against a device's dma_alignment while a bio is built from an iov_iter, so misaligned direct-I/O requests can pass initial checks. Bio-based drivers do not necessarily check the alignment split, and stacking block drivers may not handle misalignment detected after the bio has been submitted, leaving downstream behavior undefined and potentially causing kernel memory corruption or crashes. A local attacker with low privileges can trigger this by submitting misaligned vectors (e.g., via O_DIRECT or raw block device access), with CVSS 3.1 scoring indicating high impact to confidentiality, integrity, and availability — consistent with possible privilege escalation or denial of service. Any Linux system running a kernel lacking the fix is affected in principle, with the highest practical risk on multi-user hosts, containers, or systems exposing block devices to untrusted local users. No public proof of concept is known and there is no evidence of exploitation in the wild; the fix rejects misaligned vectors early with -EINVAL.

What to do: Install kernel updates from your distribution that include the iov alignment-validation fix and reboot to load the patched kernel. Where patching is delayed, restrict permissions on raw block device nodes and limit untrusted local accounts or containers capable of issuing O_DIRECT I/O. After patching, monitor for new -EINVAL errors or I/O failures from direct-I/O workloads, which indicate previously misaligned requests are now being correctly rejected.