EUVD-2026-80565
GHSA-gj9w-7mfp-hc5m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attaching a crafted BTT arena needs root/CAP_SYS_ADMIN control of the pmem device (PR:H); deterministic once presented (AC:L); OOB write not read (C:N), bounded corruption is DoS-dominant (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: reject an arena whose nfree is below the lane count
The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree. A crafted or foreign arena whose nfree is below the lane count makes freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.
btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the code does not currently honor: num_lanes is ND_MAX_LANES regardless of nfree. Reject an arena whose nfree is below num_lanes at discovery, before the per-lane arrays are allocated, enforcing that invariant.
AnalysisAI
Out-of-bounds write in the Linux kernel's nvdimm BTT (Block Translation Table) driver allows a privileged local attacker who can supply a crafted or foreign BTT arena to corrupt kernel memory, primarily degrading availability and potentially altering data. The flaw is triggered when the BTT info block's unvalidated nfree field is set below the host's per-lane count (ND_MAX_LANES), so the I/O path indexes freelist[]/rtt[] arrays past their allocations; exploitation requires local root/CAP_SYS_ADMIN or physical control over the persistent-memory medium being probed, making it a low-real-risk issue despite a high base score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to present a crafted or foreign BTT (Block Translation Table) arena on an nvdimm/persistent-memory namespace whose info-block nfree field is set below the host's per-lane count (ND_MAX_LANES). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-but-low-real-risk issue on realistic scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patch and move to a fixed release - 7.3-rc1 or 7.2.5 on mainline, or the stable backports 6.18.51, 6.12.110, 6.6.157, 6.1.188, 5.15.221, and 5.10.270 - which enforce the nlanes = min(nfree, num_cpus) invariant by rejecting any BTT arena whose nfree is below num_lanes at discovery, prior to per-lane array allocation; commit and advisory details are at the git.kernel.org stable links and https://nvd.nist.gov/vuln/detail/CVE-2026-89965. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems with the nvdimm BTT driver and confirm whether local root/CAP_SYS_ADMIN or physical access to persistent-memory media is exposed; restrict those privileges to trusted administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today