{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89557 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89557 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89557 and fix it if it is affected.\n\nWhat it is: CVE-2026-89557 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89557 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89557/ (Markdown: https://insights.sbomify.com/CVE-2026-89557/index.md)","id":"CVE-2026-89557","markdown":"https://insights.sbomify.com/CVE-2026-89557/index.md","name":"CVE-2026-89557","record":{"aliases":["AZL-100355","BELL-CVE-2026-89557","DEBIAN-CVE-2026-89557","GHSA-233m-c5r9-wq53","UBUNTU-CVE-2026-89557"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An integer overflow in the Linux kernel's md driver allows a local attacker to cause a denial of service via a crafted superblock.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: do overflow check for sb-\u003ebblog_shift in super_1_load()\n\nIn super_1_load(), sb-\u003ebblog_shift is an __u8 type value loaded from on-\ndisk superblock. It is used for badblocks API badblocks_set() by the\nfollowing sequence,\n\n 1930   rdev-\u003ebadblocks.shift = sb-\u003ebblog_shift;\n 1931   for (i = 0 ; i \u003c (sectors \u003c\u003c (9-3)) ; i++, bbp++) {\n 1932           u64 bb = le64_to_cpu(*bbp);\n 1933           int count = bb \u0026 (0x3ff);\n 1934           u64 sector = bb \u003e\u003e 10;\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\n 1936           count \u003c\u003c= sb-\u003ebblog_shift;\n 1937           if (bb + 1 == 0)\n 1938                   break;\n 1939           if (!badblocks_set(\u0026rdev-\u003ebadblocks, sector, count, 1))\n 1940                   return -EINVAL;\n 1941   }\n\nbb-\u003ebblog_shit is in range of 0-255, variable sector is 64bit width, for\nan invalid bb-\u003ebblog_shit, it is possible to make sector be overflowed\nby the following calculation,\n 1935           sector \u003c\u003c= sb-\u003ebblog_shift;\nThen in turn when call badblocks_set() at line 1939 with the invalid\nrdev-\u003ebadblocks.shift set at line 1930, may result an overflow inside\n_badblocks_clear() in block/badblocks.c.\n\nAlthough there are many places to call badblocks APIs, the non-zero\nshift value is only used in super_1_load(), other places always use 0 as\nthe shift value. Therefore it is unnecessary to do a general shift value\noverflow check inside badblock API, and just check here as the caller.\n\nThis may avoid unnecessary check, make the badblocks API code more simple\nand elegant.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"md: do overflow check for sb-\u003ebblog_shift in super_1_load()","id":"CVE-2026-89557","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"md/raid10: fix still_degraded being inverted in raid10_sync_request()","id":"CVE-2026-89558"},"packages":[],"prev":{"headline":"module: validate string table section types","id":"CVE-2026-89556"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"An integer overflow in the Linux kernel's md driver allows a local attacker to cause a denial of service via a crafted superblock.","url":"https://insights.sbomify.com/CVE-2026-89557/"}