{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89584", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-89584" ], "published": "2026-09-11T19:47:07Z", "summary": "block: validate user space vectors during extraction", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: validate user space vectors during extraction\n\nThe bio-based drivers don't necessarily check the alignment split, and\nstacking block drivers don't always handle a misalignment detected after\nsubmitting the bio. Validate user vectors against the device's\ndma_alignment as the bio is built from the iov_iter, rejecting\nmisaligned early with -EINVAL.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89584" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d44a97a3b1c00cc571245124e23e5ceb0a0225a0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/14b007e178811db72fbb1ebb3535160db6ec1e6a" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-13T06:49:25Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - Missing dma_alignment validation is in bio_iov_iter_get_pages()/iov_iter_extract_bvecs(), reached only via local O_DIRECT (preadv/pwritev/io_uring) through blkdev_direct_IO() and iomap_dio_bio_iter_one() on ext4/XFS/btrfs/f2fs or raw block devices; ksmbd/nfsd do not feed attacker-controlled user iovecs into this path.\nAC:L - After the simplified DIO checks, only file offset and total length must be logical-block aligned; the attacker fully controls each iovec address and length and can submit misaligned buffers or io_uring registered buffers deterministically, with no race or attacker-uncontrolled layout required.\nPR:L - Any unprivileged user with read or write access to a regular file on an iomap DIO filesystem, or to a block device they can open, can issue O_DIRECT with no capability; stacked dm/md/LUKS setups are a deployment precondition, not a privilege the attacker must obtain.\nUI:N - The attacker opens their own file or device and issues the misaligned O_DIRECT I/O themselves; no separate victim must mount media, confirm a prompt, or otherwise participate.\nS:U - Impact stays inside the host kernel block layer and stacked devices (invalid DMA, driver mishandling, array denial of service) and does not cross a VM, hypervisor, IOMMU, or sandbox boundary.\nC:H - Bio-based drivers (dm, md) skip __bio_split_to_limits() on normal I/O, so attacker-controlled bvec offsets reach DMA and crypto SG lists such as dm-crypt sg_set_page(). Unaligned or page-crossing DMA, including non-coherent cache-line effects and hardware address rounding, can read adjacent memory.\nI:H - The same unvalidated user vectors are programmed into device DMA and driver scatterlists; misaligned writes, hardware address masking, and cache-line tearing on non-coherent DMA can corrupt adjacent memory or neighboring disk blocks, and drivers that assume aligned bvecs can perform out-of-bounds writes.\nA:H - Misaligned bios are known to degrade md/raid1 and dm-mirror arrays when lower devices return BLK_STS_INVAL, hang dm-io on byte-granular fragments, and can oops or hang bio-based drivers and DMA engines that reject unaligned segments, all kernel-level availability failures." } } }