Junglewise Threat Intelligence

CVE-2026-89458: Linux kernel s390/dasd data corruption on failed ESE read

CVE-2026-89458 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's s390 DASD (Direct Access Storage Device) driver incorrectly marked failed thin-provisioned disk reads as successful, delivering uninitialized memory to applications instead of zeroed data. This could cause data corruption or information disclosure when reading from unallocated regions of thin-provisioned storage devices, potentially exposing sensitive information from freed memory or causing application failures.

Technical details

The vulnerability exists in the DASD interrupt handler (dasd_int_handler) for s390 architecture. When processing NRF (No Record Found) reads of unallocated ESE (Enterprise Storage Extension) tracks on thin-provisioned devices, the handler calls ese_read() to zero the destination buffer but unconditionally marks the request as DASD_CQR_SUCCESS regardless of the return value. The ese_read() function can fail early (e.g., during sense-data parsing or range validation) without zeroing the buffer. The fix checks the ese_read() return value and properly sets the request status to DASD_CQR_ERROR on failure instead of forcing success. This is a local attack vector affecting systems using s390 DASD thin-provisioned storage. Patches are available in the Linux stable tree.

Affected products

  • Linux Linux kernel Multiple versions (all s390 DASD affected versions prior to patch)

Timeline

  • 2026-09-11: disclosed
  • 2026-09-07: patched: Fix committed to stable tree

References

Related threats