Look up another CVE · open CVE-2026-89965 in the interactive tracker
CVE-2026-89965
nvdimm/btt: reject an arena whose nfree is below the lane count
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/nvdimm. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89965 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree. A crafted or foreign arena whose nfree is below the lane count makes freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write. btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the code does not currently honor: num_lanes is ND_MAX_LANES regardless of nfree. Reject an arena whose nfree is below num_lanes at discovery, before the per-lane arrays are allocated, enforcing that invariant.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/nvdimm/btt.c
- What this is
- LIBNVDIMM BTT: BLOCK TRANSLATION TABLEMAINTAINERS section matched on drivers/nvdimm/btt* · nvdimm@lists.linux.dev · Supported
- Kernel module
- nd_btt
Check it on the machine
grep -wE 'CONFIG_LIBNVDIMM|CONFIG_ND_BTT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nd_bttPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, ppc64el/powerpc64le
- trixieMnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidMnot built on armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Mnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_LIBNVDIMM, CONFIG_ND_BTT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/nvdimm
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.2 | 5.10.270 | eb491343d2d1 |
| 4.2 | 5.15.221 | 59d5cd1f42b4 |
| 4.2 | 6.1.188 | f6c5313aae79 |
| 4.2 | 6.6.157 | f9bf05c63b77 |
| 4.2 | 6.12.110 | 6f79d1a5f261 |
| 4.2 | 6.18.51 | 6b1faf1f099f |
| 4.2 | 7.2.5 | 9dfa11cef475 |
| 4.2 | 7.3 | 6a1f2e5ed926 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The OOB write is reached via local BTT block I/O after discover_arenas() accepts a crafted on-media info block (nd_pmem_probe → nd_btt_probe/nvdimm_namespace_attach_btt → btt_init, then btt_submit_bio → btt_read_pg/btt_write_pg). virtio-pmem, QEMU nvdimm, CXL/ACPI pmem, and ndctl namespaces are local device paths, not a network protocol parser.
- AC:LAttack complexity, low
- nfree is taken from the attacker-controlled BTT info block after only signature, checksum, and optional parent-UUID checks (a null UUID skips the UUID match). Setting nfree=1 below ND_MAX_LANES (256) and pinning I/O to CPU 1+ with sched_setaffinity makes rtt[lane]/freelist[lane] deterministically overrun the nfree-sized kmalloc buffers; no race is required.
- PR:LPrivileges required, low
- Neither nd_open() nor btt_submit_bio() has a capable() check. Disk-group or PMEM-service accounts can write a valid-checksum info block to /dev/pmem* (typically 0660). nd_btt_probe() auto-detects BTT even on claim_class NONE, so boot or ordinary namespace probe attaches the arena; subsequent I/O from that unprivileged principal hits the OOB without init-namespace root.
- UI:NUser interaction, none
- Once a crafted arena is discovered, device_add_disk() partition scanning issues bios into btt_read_pg() and writes rtt[lane] with no victim mount or file open. Further exploitation is attacker-driven I/O on the BTT gendisk they already can access.
- S:UScope, unchanged
- The heap out-of-bounds access corrupts kmalloc objects in the same kernel that parsed the BTT arena. This is standard kernel memory corruption, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.
- C:HConfidentiality impact, high
- btt_read_pg() stores RTT_VALID|postmap into arena->rtt[lane] and btt_write_pg() reads/writes arena->freelist[lane] past the nfree-sized allocations. postmap comes from the attacker-crafted map, so adjacent slab objects are overwritten with attacker-influenced values that can be turned into an arbitrary-read primitive.
- I:HIntegrity impact, high
- The same lane-indexed stores are kernel heap out-of-bounds writes: rtt[] (u32 with attacker-controlled postmap) and freelist[] (block/sub/seq/has_err). Combined with CPU-affinity control of the lane index (0..255), this is an OOB write exploitable for control-flow hijacking. btt_flog_write() also writes logoff+lane*LOG_GRP_SIZE on media.
- A:HAvailability impact, high
- Indexing past the nfree-sized rtt and freelist kmalloc buffers oopses or panics on poisoned slab metadata or unmapped pages. Any kernel crash from this OOB write is High availability impact and is repeatable on every I/O using a lane >= nfree.