{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89456", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.707Z", "datePublished": "2026-09-11T19:43:20.037Z", "dateUpdated": "2026-09-11T19:43:20.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:20.037Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/block/dasd_erp.c"], "versions": [{"version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "lessThan": "d6b8778b1b82aa3a8dbf8612080f635b834bd16b", "status": "affected", "versionType": "git"}, {"version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "lessThan": "ceafb262475ac6cb3a7d07b1102608be2b216b99", "status": "affected", "versionType": "git"}, {"version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "lessThan": "15ec03452c18e8d288e519837d21b308300d74b2", "status": "affected", "versionType": "git"}, {"version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "lessThan": "6fb5ba2e7e43173a3761e46f091070a8185efa14", "status": "affected", "versionType": "git"}, {"version": "fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04", "status": "affected", "versionType": "git"}, {"version": "5f7c9989f11305aaa43e0f4378f4f070022a9f2b", "status": "affected", "versionType": "git"}, {"version": "5.4.26", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.5.10", "lessThan": "5.6", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/s390/block/dasd_erp.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"}, {"url": "https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99"}, {"url": "https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2"}, {"url": "https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14"}], "title": "s390/dasd: Propagate partial completion length across ERP recovery", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/s390/block/dasd_erp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d6b8778b1b82aa3a8dbf8612080f635b834bd16b", "status": "affected", "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "versionType": "git"}, {"lessThan": "ceafb262475ac6cb3a7d07b1102608be2b216b99", "status": "affected", "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "versionType": "git"}, {"lessThan": "15ec03452c18e8d288e519837d21b308300d74b2", "status": "affected", "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "versionType": "git"}, {"lessThan": "6fb5ba2e7e43173a3761e46f091070a8185efa14", "status": "affected", "version": "5e6bdd37c5526ef01326df5dabb93011ee89237e", "versionType": "git"}, {"status": "affected", "version": "fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04", "versionType": "git"}, {"status": "affected", "version": "5f7c9989f11305aaa43e0f4378f4f070022a9f2b", "versionType": "git"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.26", "versionType": "semver"}, {"lessThan": "5.6", "status": "affected", "version": "5.5.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/s390/block/dasd_erp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: Propagate partial completion length across ERP recovery\n\ndasd_default_erp_postaction() copies the timing and device state from\nthe finished ERP request back to the original request but drops\nproc_bytes. A request that was partially completed, an ESE read of a\nnot-yet-allocated track returns fewer bytes than requested, and then\nrecovered through the ERP chain loses its partial-completion length.\n__dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole\nrequest instead of requeueing the remainder, silently returning zeroed\ndata for the part that was never read.\n\nCarry proc_bytes over to the original request like the other\nper-request state."}], "id": "CVE-2026-89456", "lastModified": "2026-09-11T20:19:26.387", "metrics": {}, "published": "2026-09-11T20:19:26.387", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Information disclosure in s390/dasd via incorrect data tracking", "id": "2532243", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532243"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, an issue exists during error recovery for disk read operations. When a request is partially completed and then recovered, the system fails to correctly propagate the length of the processed data. This can lead to the kernel silently returning zeroed data for the unread portion of a request, potentially resulting in information disclosure to a local attacker."], "name": "CVE-2026-89456", "public_date": "2026-09-11T19:43:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89456\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89456\nhttps://git.kernel.org/stable/c/15ec03452c18e8d288e519837d21b308300d74b2\nhttps://git.kernel.org/stable/c/6fb5ba2e7e43173a3761e46f091070a8185efa14\nhttps://git.kernel.org/stable/c/ceafb262475ac6cb3a7d07b1102608be2b216b99\nhttps://git.kernel.org/stable/c/d6b8778b1b82aa3a8dbf8612080f635b834bd16b"], "threat_severity": "Moderate"}

{}