The Linux kernel's dm array vulnerability (CVE-2026-89574) involved insufficient validation of array block headers on read. The array_block_check() function validated only block number and checksum, while other structural fields were bounded only by node_check(). Because dm_array_cursor_next() uses the on-disk nr_entries as a loop bound and element_at() performs unguarded pointer arithmetic, a count larger than the block capacity could cause the read to walk off the dm-bufio buffer. The vulnerability was addressed by adding strict header validation: rejecting zero value_size, requiring max_entries to exactly match the calculated maximum for the value_size and block size, and ensuring nr_entries fits within these constraints. This prevents out-of-bounds reads and potential memory corruption during dm array operations.

This vulnerability could allow out-of-bounds reads in the Linux kernel's device mapper array code, potentially leading to memory corruption or kernel crashes. However, no known exploits in the wild have been reported. The impact is limited to kernel stability and integrity during dm array operations.

A fix has been applied in the Linux kernel to enforce strict validation of dm array block headers on read, preventing out-of-bounds access. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.