{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.778Z", "datePublished": "2026-09-16T10:32:46.769Z", "dateUpdated": "2026-09-16T14:40:43.493Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:40:43.493Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block's nfree field, the number of reserve free blocks, is\nread from the medium without validation. btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree. Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The OOB write is reached via local BTT block I/O after discover_arenas() accepts a crafted on-media info block (nd_pmem_probe \u2192 nd_btt_probe/nvdimm_namespace_attach_btt \u2192 btt_init, then btt_submit_bio \u2192 btt_read_pg/btt_write_pg). virtio-pmem, QEMU nvdimm, CXL/ACPI pmem, and ndctl namespaces are local device paths, not a network protocol parser.\nAC:L - nfree is taken from the attacker-controlled BTT info block after only signature, checksum, and optional parent-UUID checks (a null UUID skips the UUID match). Setting nfree=1 below ND_MAX_LANES (256) and pinning I/O to CPU 1+ with sched_setaffinity makes rtt[lane]/freelist[lane] deterministically overrun the nfree-sized kmalloc buffers; no race is required.\nPR:L - Neither nd_open() nor btt_submit_bio() has a capable() check. Disk-group or PMEM-service accounts can write a valid-checksum info block to /dev/pmem* (typically 0660). nd_btt_probe() auto-detects BTT even on claim_class NONE, so boot or ordinary namespace probe attaches the arena; subsequent I/O from that unprivileged principal hits the OOB without init-namespace root.\nUI:N - Once a crafted arena is discovered, device_add_disk() partition scanning issues bios into btt_read_pg() and writes rtt[lane] with no victim mount or file open. Further exploitation is attacker-driven I/O on the BTT gendisk they already can access.\nS:U - The heap out-of-bounds access corrupts kmalloc objects in the same kernel that parsed the BTT arena. This is standard kernel memory corruption, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.\nC:H - btt_read_pg() stores RTT_VALID|postmap into arena->rtt[lane] and btt_write_pg() reads/writes arena->freelist[lane] past the nfree-sized allocations. postmap comes from the attacker-crafted map, so adjacent slab objects are overwritten with attacker-influenced values that can be turned into an arbitrary-read primitive.\nI:H - The same lane-indexed stores are kernel heap out-of-bounds writes: rtt[] (u32 with attacker-controlled postmap) and freelist[] (block/sub/seq/has_err). Combined with CPU-affinity control of the lane index (0..255), this is an OOB write exploitable for control-flow hijacking. btt_flog_write() also writes logoff+lane*LOG_GRP_SIZE on media.\nA:H - Indexing past the nfree-sized rtt and freelist kmalloc buffers oopses or panics on poisoned slab metadata or unmapped pages. Any kernel crash from this OOB write is High availability impact and is repeatable on every I/O using a lane >= nfree."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvdimm/btt.c"], "versions": [{"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "eb491343d2d1784121ad9af91c25b338c28913c3", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "59d5cd1f42b4bab3609512c3cb3d3540d3d21da7", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "f6c5313aae794ecca8f762c1a3493de5c266f120", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "f9bf05c63b77d000e9c01f3e47af36973887d350", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "6f79d1a5f2611a3d36e9312be5425cd9cb397c51", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "6b1faf1f099f7060b5f1f2f0d024132581f1726e", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "9dfa11cef4750b67591307f2c62e47a23d60e4b7", "status": "affected", "versionType": "git"}, {"version": "5212e11fde4d40fa627668b4f2222d20db488f71", "lessThan": "6a1f2e5ed9267ca19187038ac635393c165213ac", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvdimm/btt.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3"}, {"url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7"}, {"url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120"}, {"url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350"}, {"url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51"}, {"url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e"}, {"url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7"}, {"url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac"}], "title": "nvdimm/btt: reject an arena whose nfree is below the lane count", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvdimm/btt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eb491343d2d1784121ad9af91c25b338c28913c3", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "59d5cd1f42b4bab3609512c3cb3d3540d3d21da7", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "f6c5313aae794ecca8f762c1a3493de5c266f120", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "f9bf05c63b77d000e9c01f3e47af36973887d350", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "6f79d1a5f2611a3d36e9312be5425cd9cb397c51", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "6b1faf1f099f7060b5f1f2f0d024132581f1726e", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "9dfa11cef4750b67591307f2c62e47a23d60e4b7", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}, {"lessThan": "6a1f2e5ed9267ca19187038ac635393c165213ac", "status": "affected", "version": "5212e11fde4d40fa627668b4f2222d20db488f71", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvdimm/btt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block's nfree field, the number of reserve free blocks, is\nread from the medium without validation. btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree. Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant."}], "id": "CVE-2026-89965", "lastModified": "2026-09-16T15:18:20.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:07.033", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}