Executive brief
The Linux kernel's s390/dasd (Direct Access Storage Device) driver handles storage I/O operations on IBM System z systems. A bug in error recovery causes partial read completions to be lost, resulting in silent data corruption where the kernel returns zeroed data for portions of disk blocks that were never actually read. This can lead to application data loss or corruption when applications rely on data from thin-provisioned storage devices.
Technical details
The vulnerability is a data handling bug in the DASD error recovery path (drivers/s390/block/dasd_erp.c). When an Extent Space Efficient (ESE) read request for a not-yet-allocated track completes partially (fewer bytes than requested), the dasd_default_erp_postaction() function fails to propagate the proc_bytes field from the error recovery request back to the original request. Consequently, __dasd_cleanup_cqr() sees proc_bytes==0 and completes the entire request as successful, silently returning zeroed data instead of requeueing for the unread portion. The fix is a simple three-line change preserving proc_bytes during ERP recovery, ensuring partial completion information is not lost. The vulnerability affects all Linux kernel versions; patches are available in the stable kernel series.
Affected products
- Linux Linux kernel all versions (fix available in stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89456 published
- 2026-08-05: patched: Upstream fix committed by Stefan Haberland
- 2026-09-07: patched: Fix merged to stable kernel branches