CVE-2026-89458

CVE-2026-89458

published September 12, 2026

CVSS
—
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Do not complete a failed ESE read as successful

dasd_int_handler() completes an NRF read of an unallocated ESE track by

calling ese_read() and unconditionally marking the request

DASD_CQR_SUCCESS. dasd_eckd_ese_read() can return an error before it has

zeroed the destination buffer: a failed sense-data parse or a current

track outside the requested range both return early, leaving the

destination pages untouched. The request is still completed successfully,

so the block layer is handed stale / uninitialized memory instead of

zeros.

Check the ese_read() return value and fail the request through the normal

error path instead of forcing DASD_CQR_SUCCESS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Published
2026-09-12T00:19Z
References (8)
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 19:43Z
    s390/dasd: Do not complete a failed ESE read as successful
    cvelistv5