Cloudanix VulnDB

CVE-2026-89559

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel handles certain memory device labels could let a logged-in attacker damage or take over the entire computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow in 32-bit multiplication of nslot and label_size in __nd_label_validate() bypasses a bounds check, allowing nd_label_data_init() to perform an out-of-bounds memset write past the config buffer when processing untrusted label data from media or ND_CMD_SET_CONFIG_DATA.

Why it matters to the business

Systems using NVDIMM persistent memory may experience kernel memory corruption, enabling local attackers to crash the system or execute arbitrary code with kernel privileges, potentially leading to full host compromise or data integrity loss on affected servers and appliances.

How an attack unfolds

An attacker with local access supplies a crafted nslot value via the label storage area or the ND_CMD_SET_CONFIG_DATA ioctl. The 32-bit product wraps, evading the size check, and nd_label_data_init() then writes beyond the allocated config buffer during label initialization.

How to fix it

Update to a Linux kernel containing the fix that performs the nslot * label_size multiplication in 64 bits. Reboot affected systems after applying the kernel update. Where immediate patching is impossible, restrict unprivileged access to NVDIMM configuration ioctls via LSM or seccomp policies.

How to confirm the fix worked

Confirm the kernel source contains the 64-bit evaluation of the product before the bounds check, or verify the running kernel version is newer than the commit that introduced the 32-bit narrowing. Test with a synthetic label containing a large nslot value and ensure no oops or memory corruption occurs.

Typical attack path

  1. Obtain local shell or user context on a Linux host exposing NVDIMM label interfaces
  2. Craft malicious namespace label data with oversized nslot field
  3. Invoke ND_CMD_SET_CONFIG_DATA or present the data via DIMM label storage
  4. Trigger label validation and initialization paths to cause the overflow and write

How to detect it

Review kernel logs for oops or BUG reports referencing nd_label_data_init or __nd_label_validate during DIMM label processing. Correlate with processes invoking ND_CMD_SET_CONFIG_DATA or writing to /dev/nvdimm* control devices.

What your security team should do

  • Prioritize kernel updates on all hosts that expose libnvdimm or NVDIMM devices
  • Audit and restrict local user access to ND_CMD_* ioctls where possible
  • Monitor for kernel oops or crashes during namespace label initialization

The record

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespace index field nslot is a u32 read from the DIMM label storage area. __nd_label_validate() bounds it against the config area size, but sizeof_namespace_label() returns unsigned, so the product nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before the comparison. A crafted nslot passes the bound and is then used as the loop trip count in nd_label_data_init(), whose memset() walks off the end of the config_size buffer: an out-of-bounds write. The field is not trusted -- it comes from the medium, or from userspace via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound check is exact; conforming labels are unaffected. The check was safe when introduced by commit 4a826c83db4e ("libnvdimm: namespace indices: read and validate"): it multiplied by sizeof(struct nd_namespace_label), a size_t, so on a 64-bit build the product did not wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions") narrowed it to 32 bits when the label size became a runtime value read via sizeof_namespace_label().

Affected packages

Ecosystem Package Introduced Fixed