CVE intelligence

CVE-2026-89456

Vulnerability intelligence

Published Sep 11, 2026Sources checked Nov 3, 2026

7.0HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-89456 and is rated High severity with a CVSS score of 7.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.1%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-89456?

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Propagate partial completion length across ERP recovery

dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes.

A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.

Carry proc_bytes over to the original request like the other per-request state.

Source: NVD