Executive brief
The Linux kernel's NVDIMM (Non-Volatile DIMM) label validation code contains an integer overflow vulnerability that can be triggered by specially crafted DIMM label data. An attacker with the ability to write to DIMM label storage (either physically or through a privileged interface) can cause the kernel to write beyond the bounds of a memory buffer, potentially leading to kernel memory corruption, denial of service, or privilege escalation.
Technical details
The vulnerability is an integer overflow in the __nd_label_validate() function in drivers/nvdimm/label.c. The nslot field (a 32-bit unsigned value read from DIMM media) is multiplied by sizeof_namespace_label() to validate against config area size, but the multiplication occurs in 32-bit arithmetic and wraps modulo 2^32 before the bounds check. A crafted nslot value can pass the validation despite exceeding the buffer size, then gets used as a loop count in nd_label_data_init() where a memset() operation writes beyond the allocated config_size buffer. The vulnerability affects all callers of __nd_label_validate() and can be triggered via untrusted data from the DIMM medium or userspace via the ND_CMD_SET_CONFIG_DATA interface. The fix forces the multiplication to 64-bit arithmetic by casting nslot to u64, ensuring the bounds check is exact and preventing overflow. Patches have been committed to the Linux kernel stable tree.
Affected products
- Linux Linux kernel 4.0 and later (introduced in commit 564e871aa66f, likely affecting all versions from 4.0 through at least 6.x series prior to patch)
Timeline
- 2026-09-11: disclosed: CVE-2026-89559 published
- 2026-06-24: patched: Patch authored by Bryam Vargas; commit 037770686126155eafc44501312989e2837b9659
- 2026-09-07: patched: Patch merged into stable kernel releases by Greg Kroah-Hartman; commit 09e649117c54b7e1c004f22eaa19efbadd9ac856