CVE-2026-89458

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Do not complete a failed ESE read as successful

dasd_int_handler() completes an NRF read of an unallocated ESE track by

calling ese_read() and unconditionally marking the request

DASD_CQR_SUCCESS. dasd_eckd_ese_read() can return an error before it has

zeroed the destination buffer: a failed sense-data parse or a current

track outside the requested range both return early, leaving the

destination pages untouched. The request is still completed successfully,

so the block layer is handed stale / uninitialized memory instead of

zeros.

Check the ese_read() return value and fail the request through the normal

error path instead of forcing DASD_CQR_SUCCESS.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References