Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89456— s390/dasd: Propagate partial completion length across ERP recovery

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.6版本存在安全漏洞，该漏洞源于dasd_default_erp_postaction()未保留部分完成长度proc_bytes，导致__dasd_cleanup_cqr()将部分完成请求误判为完成并静默返回未读取部分的零数据。

CVSS 7.0 · High EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1490 · Inhibit System Recovery

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux 5e6bdd37c5526ef01326df5dabb93011ee89237e< 9e063165d3fe58db2a517717b830f17e82d03467 affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< 6b0954c8a259da1e4aa745989f82723947acfb46 affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< f735b9710f0c8fe72c1060103e865f4ae678190b affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< d6b8778b1b82aa3a8dbf8612080f635b834bd16b affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< ceafb262475ac6cb3a7d07b1102608be2b216b99 affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< 15ec03452c18e8d288e519837d21b308300d74b2 affected
5e6bdd37c5526ef01326df5dabb93011ee89237e< 6fb5ba2e7e43173a3761e46f091070a8185efa14 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89456

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
s390/dasd: Propagate partial completion length across ERP recovery
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.6版本存在安全漏洞，该漏洞源于dasd_default_erp_postaction()未保留部分完成长度proc_bytes，导致__dasd_cleanup_cqr()将部分完成请求误判为完成并静默返回未读取部分的零数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5e6bdd37c5526ef01326df5dabb93011ee89237e ~ 9e063165d3fe58db2a517717b830f17e82d03467 -
Linux Linux 5.6 -

II. Public POCs for CVE-2026-89456

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89456

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89456 (5)

Other References for CVE-2026-89456 (1)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89674 9.8 CRITICAL nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89675 9.8 CRITICAL nfsd: fix UAF in async copy cancel and shutdown
CVE-2026-89676 9.8 CRITICAL nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
CVE-2026-89677 9.8 CRITICAL nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
CVE-2026-89681 9.8 CRITICAL nfsd: fix layout fence worker double-reference race
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89702 9.8 CRITICAL nfsd: size fh_verify server sockaddr slot by xpt_locallen
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89456

No comments yet

Leave a comment