From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A377F57ED84 for ; Fri, 11 Sep 2026 19:51:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156283; cv=none; b=GYGUsdjwBSWw8fyUMP0JBERw9r10OcBJnjN8EFjwTf5eT4KWNPeqdcU65K0J+z8bY8idrvCU9GwBusH2trQj+gtd7BVADXdU26RdXkz7pqo0DO5VBwJtth3C7HMisSFJDJ7XD/idtXKCJ8PQkcmpMMgytyk/T7UX+oXPU8snWaY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156283; c=relaxed/simple; bh=pC5wFMlaPad4XgeDiYLGNfmnxkOCPtI4si9BKd9WZ4w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=oxATyzGxwLs/r1snZRmMZ6OPzRiXC+JgD1Pc2Eaqbxc3Irr2OBwuxXvyYt/0sGhHLWBH0aAhCIXMpK5TkpFxOp1lN2ZN/KNq727f8BWxlg9G1jEruPvfzNqqQFaZK6lLTcNVy1L4KnleVJp9lv7d8T6UuU3kfjb1GwvfOyclfIg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SZNNav8u; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="SZNNav8u" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E8061F00899; Fri, 11 Sep 2026 19:50:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156257; bh=2nDGFz9KrMLal0aCBeJ+lAXnyfff7qNrytA34YJevCU=; h=From:To:Cc:Subject:Date:Reply-To; b=SZNNav8uPpoPxXLOJU2qu2e0CN/61Kw2VeJlC6+MstKkUWEnHpBKdo7UibqpSwuPh Ik93vaTFE2CizOg/tQNJagWh2jxaaKQ8/NyCRy/XWYPTZGH/mc2KlnugPRqtZqz2oZ 7X1U1cbIR9kjSGyNNTXuBPsXdrIq12ziZffKJkL8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89457: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Date: Fri, 11 Sep 2026 21:42:26 +0200 Message-ID: <2026091100-CVE-2026-89457-4797@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2720; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=N+eSXMwvXXcbgVjfpjxdlRDuibS7YjVNZAXYA66sG1M=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIn1uHW+6xC2r4OFmKWPJeJzxxJQTpX0Jemw9XMdX7 tmTG+LSEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABPxsGJYsEA52m1pz+9rZdY/ zOf48rgxe99+wjA/m+lxfsccm9cLS97O7dn5k9Hu5ab3AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device->private, either directly or through the DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics. Guard the dereference inside each callback that actually touches device->private. The Linux kernel CVE team has assigned CVE-2026-89457 to this issue. Affected and fixed versions =========================== Issue introduced in 5.3 with commit c729696bcf8b23450043dd9c9972c15e53419ae4 and fixed in 6.12.109 with commit 536407b272402af679155910d7fdeeb4834eefb9 Issue introduced in 5.3 with commit c729696bcf8b23450043dd9c9972c15e53419ae4 and fixed in 6.18.50 with commit 6452c13646af7c13d7f6668b6690cfb2427e7f7b Issue introduced in 5.3 with commit c729696bcf8b23450043dd9c9972c15e53419ae4 and fixed in 7.2.4 with commit 449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5 Issue introduced in 5.3 with commit c729696bcf8b23450043dd9c9972c15e53419ae4 and fixed in 7.3-rc1 with commit 2a1780f9fc2493bd34c418a0be6fc58943afcecf Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89457 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/s390/block/dasd_eckd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/536407b272402af679155910d7fdeeb4834eefb9 https://git.kernel.org/stable/c/6452c13646af7c13d7f6668b6690cfb2427e7f7b https://git.kernel.org/stable/c/449f3bada7a9fad8b8cdf4bb20baf27ee9ca56c5 https://git.kernel.org/stable/c/2a1780f9fc2493bd34c418a0be6fc58943afcecf