CVE-2026-89656 (GCVE-0-2026-89656)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-19 08:50
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose(). Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.
References
Impacted products
Vendor Product Version
Linux Linux Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
Version: 66a0e2d579dbec5c676cfe446234ffebb267c564
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:25:30.231032Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:47.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "baad5875fdd2f5e248250fc3519bb045d64f1716",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "4aeb93daadf388e72073abc204312dd364eeb30a",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "3516a4131c4e45d62ee4e42e82c36930e8c1fbbd",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "00562ccd4e88d092b9b851df50fad20442bfeb24",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "79900d978158b2d80eef952fc41b9e4dc58d7b83",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "3cde4a8302301679937474a5f7a851394cc1bd11",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket\u0027s\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket\u0027s permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc\u0027d CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.\nAC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket\u0027s permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc\u0027d CRUSH workspace without races or rare configs.\nPR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.\nUI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.\nS:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.\nI:H - bucket_perm_choose() writes the source bucket\u0027s permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.\nA:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:27.849Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"
        },
        {
          "url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"
        },
        {
          "url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"
        },
        {
          "url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"
        }
      ],
      "title": "libceph: reject buckets with mismatched CRUSH ids",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89656",
    "datePublished": "2026-09-11T19:45:45.483Z",
    "dateReserved": "2026-09-11T19:38:34.743Z",
    "dateUpdated": "2026-10-19T08:50:27.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89656\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:25:30.231032Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:25:31.039Z\"}}], \"cna\": {\"title\": \"libceph: reject buckets with mismatched CRUSH ids\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.\\nAC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket\u0027s permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc\u0027d CRUSH workspace without races or rare configs.\\nPR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.\\nUI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.\\nS:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\\nC:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.\\nI:H - bucket_perm_choose() writes the source bucket\u0027s permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.\\nA:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"baad5875fdd2f5e248250fc3519bb045d64f1716\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"4aeb93daadf388e72073abc204312dd364eeb30a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"3516a4131c4e45d62ee4e42e82c36930e8c1fbbd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"00562ccd4e88d092b9b851df50fad20442bfeb24\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"79900d978158b2d80eef952fc41b9e4dc58d7b83\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66a0e2d579dbec5c676cfe446234ffebb267c564\", \"lessThan\": \"3cde4a8302301679937474a5f7a851394cc1bd11\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ceph/osdmap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ceph/osdmap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a\"}, {\"url\": \"https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716\"}, {\"url\": \"https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a\"}, {\"url\": \"https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022\"}, {\"url\": \"https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd\"}, {\"url\": \"https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24\"}, {\"url\": \"https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83\"}, {\"url\": \"https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: reject buckets with mismatched CRUSH ids\\n\\ncrush_decode() stores bucket data by array slot, and the mapper later\\nderives the per-bucket workspace index from the decoded bucket id. A\\nmalformed map can therefore make one bucket reuse another bucket\u0027s\\nworkspace by encoding an id different from -1 - slot.\\n\\nFor uniform buckets, the second replica selection expands the source\\nbucket\u0027s permutation into that aliased workspace buffer. If the source\\nbucket is larger than the aliased bucket, the write runs past the smaller\\npermutation array and can escape the kvmalloc\u0027d CRUSH workspace. KASAN\\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\\n\\nReject buckets whose encoded id does not match their array slot. Valid\\nCRUSH maps already use the canonical negative id corresponding to the\\nbucket slot, so this restores the invariant expected by\\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.270\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.221\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.188\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.157\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.109\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"4.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-19T08:50:27.849Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89656\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T08:50:27.849Z\", \"dateReserved\": \"2026-09-11T19:38:34.743Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:45:45.483Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.