Executive brief
The Linux kernel's device mapper RAID1 logging component contains a buffer overflow vulnerability in string construction. An attacker with local access to the system could trigger the overflow through crafted input to the userspace log, potentially leading to kernel memory corruption and privilege escalation.
Technical details
The vulnerability is a classic off-by-one buffer overflow in the build_constructor_string() function within drivers/md/dm-log-userspace-base.c. The code allocates a buffer for constructing a string but fails to account for the NUL-terminator byte when calculating required space: it reserves 20 bytes for a 64-bit number but does not add 1 for the terminating null character. When sprintf() writes the formatted string, it writes beyond the allocated buffer boundary. The vulnerability requires local access to trigger the device mapper RAID1 userspace log mechanism. The fix simply adds one additional byte to the buffer allocation (str_size++; /* For NUL-terminator */). Patches are available in kernel stable branches.
Affected products
- Linux Linux kernel 2.6.11 through 6.19 and later (all versions prior to patched stable releases)
Timeline
- 2026-09-11: disclosed: CVE-2026-89575 published
- 2026-07-19: patched: Fix committed by Ilya Krutskih (commit 73c37fe54cd056d07461b142ab0b8b81e1ef6ad8)
- 2026-09-07: patched: Backport merged to stable branches