In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read array_block_check() validates blocknr and csum and nothing else, while node_check(), next to it, has bounded the structural fields since both were written. dm_array_cursor_next() takes its loop bound from the on-disk nr_entries and element_at() is unguarded pointer arithmetic, so a count larger than the block holds keeps the cursor in one block while the index grows past it and the read walks off the dm-bufio buffer -- dm_cache_load_mappings() drives it once per cache block at activation. Check the header against itself: reject a zero value_size, require max_entries to equal calc_max_entries() for that value_size and block size, and require nr_entries to fit. Equality rather than an upper bound, since a count below the real capacity trips BUG_ON() in fill_ablock() and trim_ablock(). Metadata dm-array writes satisfies all three.

A flaw was found in the Linux kernel's device mapper (dm) array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk `nr_entries` value. This can lead to an out-of-bounds read from the `dm-bufio` buffer, potentially resulting in memory corruption or information disclosure.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 10 Fix deferred kernel-rt Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89574 https://nvd.nist.gov/vuln/detail/CVE-2026-89574 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89574.mbox