In the Linux kernel, the following vulnerability has been resolved:

md: do overflow check for sb->bblog_shift in super_1_load()

In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-
disk superblock. It is used for badblocks API badblocks_set() by the
following sequence,

1930 rdev->badblocks.shift = sb->bblog_shift;
1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
1932 u64 bb = le64_to_cpu(*bbp);
1933 int count = bb & (0x3ff);
1934 u64 sector = bb >> 10;
1935 sector <<= sb->bblog_shift;
1936 count <<= sb->bblog_shift;
1937 if (bb + 1 == 0)
1938 break;
1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))
1940 return -EINVAL;
1941 }

bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for
an invalid bb->bblog_shit, it is possible to make sector be overflowed
by the following calculation,
1935 sector <<= sb->bblog_shift;
Then in turn when call badblocks_set() at line 1939 with the invalid
rdev->badblocks.shift set at line 1930, may result an overflow inside
_badblocks_clear() in block/badblocks.c.

Although there are many places to call badblocks APIs, the non-zero
shift value is only used in super_1_load(), other places always use 0 as
the shift value. Therefore it is unnecessary to do a general shift value
overflow check inside badblock API, and just check here as the caller.

This may avoid unnecessary check, make the badblocks API code more simple
and elegant.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2699b67223aca6b1450fc2f72e40fada952afc85 affected < 75d15738fd33a782606d0dc80cfeff47edf2ddd8
2699b67223aca6b1450fc2f72e40fada952afc85 affected < 3b097416b4cff77285c1f472fc2c4058d8a7554f
2699b67223aca6b1450fc2f72e40fada952afc85 affected < df7d4d011d5ace20699ea948712f09f9ac08924f
2699b67223aca6b1450fc2f72e40fada952afc85 affected < 35d522bd32462afcf1981dab6da8a9256c26c1e0
Linux Linux affected
Version Status Constraints
3.1 affected —
0 unaffected < 3.1
6.12.109 unaffected ≤ 6.12.*
6.18.50 unaffected ≤ 6.18.*
7.2.4 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-89557 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-89557 cve-icon
History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence, 1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 1938 break; 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1)) 1940 return -EINVAL; 1941 } bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for an invalid bb->bblog_shit, it is possible to make sector be overflowed by the following calculation, 1935 sector <<= sb->bblog_shift; Then in turn when call badblocks_set() at line 1939 with the invalid rdev->badblocks.shift set at line 1930, may result an overflow inside _badblocks_clear() in block/badblocks.c. Although there are many places to call badblocks APIs, the non-zero shift value is only used in super_1_load(), other places always use 0 as the shift value. Therefore it is unnecessary to do a general shift value overflow check inside badblock API, and just check here as the caller. This may avoid unnecessary check, make the badblocks API code more simple and elegant.
Title md: do overflow check for sb->bblog_shift in super_1_load()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:44:29.857Z

Reserved: 2026-09-11T19:38:34.724Z

Link: CVE-2026-89557

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:39.403

Modified: 2026-09-11T20:19:39.403

Link: CVE-2026-89557

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:29Z

Links: CVE-2026-89557 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses