Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-89458

s390/dasd: Do not complete a failed ESE read as successful

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.5, 5.6, 5.10.270, 5.15.221, 6.1.188, and 4 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasd_int_handler() completes an NRF read of an unallocated ESE track by calling ese_read() and unconditionally marking the request DASD_CQR_SUCCESS. dasd_eckd_ese_read() can return an error before it has zeroed the destination buffer: a failed sense-data parse or a current track outside the requested range both return early, leaving the destination pages untouched. The request is still completed successfully, so the block layer is handed stale / uninitialized memory instead of zeros. Check the ese_read() return value and fail the request through the normal error path instead of forcing DASD_CQR_SUCCESS.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in 8cb96cffceead3cbd0541154d7ecc5e6474edda1; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in 77168af195d04b34c6de62b874624e74d64cef8d; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in 921ff697bb6f7067059793becf8b2d00de71ce41; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in 55f4df40178cdfede0d7ae848fbab00efa9b95c1; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in c9adf8399732306dfc97b3adb4778038743e3f5e; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in 52b331c99baac653ca794bd8487c8ec4de8db203; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in b0d94dd6e82df396e2254c8b0f25eff7d19c2e7f; From 5e6bdd37c5526ef01326df5dabb93011ee89237e · fixed in cddb447c62466f3076938ce120028d7b591f9f37; From 5.4.26 · fixed in 5.5; From 5.5.10 · fixed in 5.6

  • Linux Linux

    5.6

  • KernelLinux

    From 5.6.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 8

git.kernel.org