Linux Kernel EUVD-2026-87061

Requires a Linux system with NVDIMM/persistent-memory storage served by the nvdimm pmem driver, and the vulnerable path is only reached when a REQ_PREFLUSH flush genuinely fails at the device; normal operation with healthy flushes is unaffected. The attacker/process needs local, low-privileged ability to submit block I/O to the pmem device (PR:L, AV:L) and no user interaction is required. Strong limiting factors: not network-reachable, confined to the uncommon pmem subsystem, and dependent on an actual flush error condition that is not directly attacker-controlled - making reliable deliberate exploitation unlikely and the practical impact centered on silent data-durability loss rather than classic compromise.

This is a low-to-moderate priority correctness bug, not an urgent threat. The input CVSS of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a local, low-privilege issue with no confidentiality or integrity impact and only availability impact, which is already modest. All exploitation signals point the same low-risk direction and do not conflict: EPSS is 0.15% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced - so exploitation status is 'no public exploit identified at time of analysis.' CWE-754 (improper check of unusual conditions) confirms this is an error-handling defect that only manifests when a REQ_PREFLUSH flush actually fails - an event outside attacker control and tied to NVDIMM/persistent-memory hardware. One notable mismatch worth flagging: the input marks CVSS AC:L, but the bug only triggers when a preflush error genuinely occurs, which is an uncommon, non-attacker-controlled condition more consistent with higher attack complexity - verify against the kernel commit. Net assessment: a real data-durability correctness fix for systems using pmem, but a very low real-world weaponization risk and not a patch-tonight priority for most fleets.

On a system using NVDIMM persistent memory via the pmem driver, a local low-privileged process issues writes with flush/FUA semantics while the underlying device's REQ_PREFLUSH flush fails. Under the flawed ordering, data writes proceed after the failed preflush and the bio can complete successfully, so the application believes prior data was durably ordered when it was not, risking silent data loss or corruption after a crash or power loss. No public proof-of-concept exists, and triggering requires the preflush to actually fail rather than any attacker-supplied payload.