In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(),… (CVE-2026-89557)
A vulnerability in the Linux kernel md subsystem was resolved involving an overflow check for the sb->bblog_shift value in the super_1_load() function. The issue arises because sb->bblog_shift, an 8-bit value loaded from disk, is used to shift a 64-bit sector value without proper overflow validation, potentially causing an overflow in badblocks_set() and subsequently in _badblocks_clear(). The fix involves adding an overflow check specifically in super_1_load() to prevent invalid shift values, simplifying the badblocks API by avoiding unnecessary general checks.
AI Analysis
Technical Summary
The Linux kernel md subsystem had a vulnerability where the sb->bblog_shift value, an __u8 loaded from the on-disk superblock, was used in a left shift operation on a 64-bit sector value without overflow validation in super_1_load(). This could cause an overflow in the sector calculation and lead to an overflow inside _badblocks_clear() when badblocks_set() is called. Since non-zero shift values are only used in super_1_load(), the fix adds an overflow check at this caller site rather than in the general badblocks API, improving code simplicity and preventing the overflow condition.
Potential Impact
If exploited, the vulnerability could cause an integer overflow during badblocks processing in the Linux kernel md subsystem, potentially leading to incorrect memory operations or kernel instability. However, no known exploits are reported in the wild. The impact is limited to the md subsystem's handling of badblocks with non-zero shift values.
Mitigation Recommendations
A fix has been implemented that adds an overflow check for sb->bblog_shift in the super_1_load() function. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. No additional general badblocks API checks are necessary.
In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(),… (CVE-2026-89557)
Description
A vulnerability in the Linux kernel md subsystem was resolved involving an overflow check for the sb->bblog_shift value in the super_1_load() function. The issue arises because sb->bblog_shift, an 8-bit value loaded from disk, is used to shift a 64-bit sector value without proper overflow validation, potentially causing an overflow in badblocks_set() and subsequently in _badblocks_clear(). The fix involves adding an overflow check specifically in super_1_load() to prevent invalid shift values, simplifying the badblocks API by avoiding unnecessary general checks.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel md subsystem had a vulnerability where the sb->bblog_shift value, an __u8 loaded from the on-disk superblock, was used in a left shift operation on a 64-bit sector value without overflow validation in super_1_load(). This could cause an overflow in the sector calculation and lead to an overflow inside _badblocks_clear() when badblocks_set() is called. Since non-zero shift values are only used in super_1_load(), the fix adds an overflow check at this caller site rather than in the general badblocks API, improving code simplicity and preventing the overflow condition.
Potential Impact
If exploited, the vulnerability could cause an integer overflow during badblocks processing in the Linux kernel md subsystem, potentially leading to incorrect memory operations or kernel instability. However, no known exploits are reported in the wild. The impact is limited to the md subsystem's handling of badblocks with non-zero shift values.
Mitigation Recommendations
A fix has been implemented that adds an overflow check for sb->bblog_shift in the super_1_load() function. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. No additional general badblocks API checks are necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-233m-c5r9-wq53
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89557"]
Threat ID: 6aa4a01255bf5e2cf5a866b6
Added to database: 09/12/2026, 00:42:58 UTC
Last enriched: 09/12/2026, 01:07:43 UTC
Last updated: 09/12/2026, 01:07:43 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.