CVE-2026-89456

s390/dasd: Propagate partial completion length across ERP recovery

HIGH
7
CVSS Score
Published: September 11, 2026 at 07:43 PM UTC
Updated: October 19, 2026 at 09:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.4.265.5.105.65e6bdd37c5526ef01326df5dabb93011ee89237e5f7c9989f11305aaa43e0f4378f4f070022a9f2bfbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04
Vendor states this is fixed in 15ec03452c18e8d288e519837d21b308300d74b2 (fixed)
Vendor states this is fixed in 6b0954c8a259da1e4aa745989f82723947acfb46 (fixed)
Vendor states this is fixed in 6fb5ba2e7e43173a3761e46f091070a8185efa14 (fixed)
Vendor states this is fixed in 9e063165d3fe58db2a517717b830f17e82d03467 (fixed)
Vendor states this is fixed in ceafb262475ac6cb3a7d07b1102608be2b216b99 (fixed)
Vendor states this is fixed in d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f (fixed)
Vendor states this is fixed in d6b8778b1b82aa3a8dbf8612080f635b834bd16b (fixed)
Vendor states this is fixed in f735b9710f0c8fe72c1060103e865f4ae678190b (fixed)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.6 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.109 (unaffected)
Vendor states this is fixed in 6.18.50 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.4 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

7HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card