CVE-2026-89575

What it actually does

Insufficient buffer allocation in dm-raid1 build_constructor_string() allows sprintf() of a 20-digit long long value to overwrite the terminating NUL byte, producing a classic stack buffer overflow.

Why it matters to the business

Systems using the device-mapper RAID1 target may experience kernel crashes, memory corruption, or local privilege escalation, potentially disrupting storage services and data availability; low EPSS and absence from KEV indicate limited real-world exploitation pressure at present.

How an attack unfolds

An attacker with local access crafts or triggers a dm-raid1 device configuration whose constructor string generation passes a long long value whose decimal representation fills the entire allocated buffer, causing the subsequent NUL write to corrupt adjacent stack data and enabling control-flow hijacking or denial of service.

How to fix it

Upgrade to a Linux kernel containing the commit that reserves space for the NUL terminator in build_constructor_string(); apply the vendor-supplied kernel package update and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the referenced fix by inspecting the dm-raid1 source or matching the kernel version against the upstream patch; recompile or reload the dm-raid1 module and verify no buffer-size warnings appear during device creation.

Typical attack path

1. Obtain local code execution or shell on a system exposing the dm-raid1 target
2. Issue a device-mapper ioctl or userspace command that invokes build_constructor_string() with a maximal long long value
3. Trigger the off-by-one overflow during sprintf()
4. Leverage the resulting memory corruption for privilege escalation or kernel panic

How to detect it

Review kernel logs for dm-raid1 related oops or stack traces around device creation; examine auditd or syscall logs for unusual device-mapper ioctl sequences; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on systems that actively use dm-raid1 targets
• Monitor upstream stable kernel releases for the backported fix
• Limit untrusted local access on storage servers until patched
• Reassess after 30 days if EPSS rises above 0.01