CVE-2026-89708 (GCVE-0-2026-89708)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-19 08:51
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpc_task that dereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes cl_callback_wq, but once nfsd4_run_cb_work() has called rpc_call_async() the rpc_task lives on rpciod; flushing the workqueue does not wait for it. rpc_shutdown_client() does drain rpciod tasks, but uses a 1-second wait_event_timeout — tasks stuck in rpc_delay() (e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain. destroy path rpciod ------------ ------ unhash_session(ses) nfsd4_probe_callback_sync(clp) flush_workqueue(cl_callback_wq) /* returns; rpc_task still live */ nfsd4_put_session_locked(ses) free_session(ses) -> kfree(ses) nfsd4_cb_sequence_done() reads cb_clp->cl_cb_session /* freed slab */ A second window exists in nfsd4_process_cb_update(). When __nfsd4_find_backchannel() returns NULL because unhash_session() has already removed the destroyed session from cl_sessions, setup_callback_client() takes the v4.1 early return so clp->cl_cb_session = ses never fires and the field retains a pointer to the about-to-be-freed session. Fix both by converting cl_cb_session to an RCU-protected pointer: - Move the cl_cb_session = ses assignment in setup_callback_client() to after rpc_create() succeeds, so it is only published when a working backchannel exists. Clear cl_cb_session on the error return in nfsd4_process_cb_update(). Both stores use rcu_assign_pointer(). - Annotate cl_cb_session with __rcu. All rpciod-side readers use rcu_read_lock()/rcu_dereference() and check for NULL, bailing to the appropriate error or requeue path: encode_cb_sequence4args(), decode_cb_sequence4resok(), nfsd41_cb_get_slot(), nfsd41_cb_release_slot(), nfsd4_cb_prepare(), and nfsd4_cb_sequence_done(). - Switch __free_session() from kfree() to kfree_rcu() so the session slab is not reclaimed until after an RCU grace period, guaranteeing that rpciod readers inside rcu_read_lock() never dereference freed memory. - Pass the session pointer to the nfsd_cb_seq_status and nfsd_cb_free_slot tracepoints instead of having them re-read cl_cb_session. - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL, routing through the done/release path to requeue the callback.
References
Impacted products
Vendor Product Version
Linux Linux Version: dcbeaa68dbbdacbbb330a86c7fc95a28473fc209
Version: dcbeaa68dbbdacbbb330a86c7fc95a28473fc209
Version: dcbeaa68dbbdacbbb330a86c7fc95a28473fc209
Version: dcbeaa68dbbdacbbb330a86c7fc95a28473fc209
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:26:20.755207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:49.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4callback.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/state.h",
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2775ec1d617e665eab71ce0f13ab1f7959713a2b",
              "status": "affected",
              "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209",
              "versionType": "git"
            },
            {
              "lessThan": "f164eb52b6f3cbf40f07fe379f9f421f88e02f76",
              "status": "affected",
              "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209",
              "versionType": "git"
            },
            {
              "lessThan": "13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25",
              "status": "affected",
              "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209",
              "versionType": "git"
            },
            {
              "lessThan": "01c5d5f58a5db9b0ee5afba2e49d3157788687b2",
              "status": "affected",
              "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4callback.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/state.h",
            "fs/nfsd/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\n\nAfter a DESTROY_SESSION the per-session teardown path can free a\nsession while rpciod still holds an inflight callback rpc_task that\ndereferences clp-\u003ecl_cb_session.  nfsd4_probe_callback_sync() flushes\ncl_callback_wq, but once nfsd4_run_cb_work() has called\nrpc_call_async() the rpc_task lives on rpciod; flushing the workqueue\ndoes not wait for it.  rpc_shutdown_client() does drain rpciod tasks,\nbut uses a 1-second wait_event_timeout \u2014 tasks stuck in rpc_delay()\n(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.\n\n    destroy path                       rpciod\n    ------------                       ------\n    unhash_session(ses)\n    nfsd4_probe_callback_sync(clp)\n      flush_workqueue(cl_callback_wq)\n      /* returns; rpc_task still live */\n    nfsd4_put_session_locked(ses)\n    free_session(ses) -\u003e kfree(ses)\n                                       nfsd4_cb_sequence_done()\n                                         reads cb_clp-\u003ecl_cb_session\n                                         /* freed slab */\n\nA second window exists in nfsd4_process_cb_update().  When\n__nfsd4_find_backchannel() returns NULL because unhash_session() has\nalready removed the destroyed session from cl_sessions,\nsetup_callback_client() takes the v4.1 early return so\nclp-\u003ecl_cb_session = ses never fires and the field retains a pointer\nto the about-to-be-freed session.\n\nFix both by converting cl_cb_session to an RCU-protected pointer:\n\n  - Move the cl_cb_session = ses assignment in setup_callback_client()\n    to after rpc_create() succeeds, so it is only published when a\n    working backchannel exists.  Clear cl_cb_session on the error\n    return in nfsd4_process_cb_update().  Both stores use\n    rcu_assign_pointer().\n\n  - Annotate cl_cb_session with __rcu.  All rpciod-side readers use\n    rcu_read_lock()/rcu_dereference() and check for NULL, bailing to\n    the appropriate error or requeue path:\n    encode_cb_sequence4args(), decode_cb_sequence4resok(),\n    nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),\n    nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().\n\n  - Switch __free_session() from kfree() to kfree_rcu() so the\n    session slab is not reclaimed until after an RCU grace period,\n    guaranteeing that rpciod readers inside rcu_read_lock() never\n    dereference freed memory.\n\n  - Pass the session pointer to the nfsd_cb_seq_status and\n    nfsd_cb_free_slot tracepoints instead of having them re-read\n    cl_cb_session.\n\n  - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,\n    routing through the done/release path to requeue the callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is in nfsd NFSv4.1 session teardown (nfsd4_destroy_session) and the rpciod callback path (nfsd4_cb_sequence_done). DESTROY_SESSION and the inflight CB_COMPOUND run over TCP/2049, so a remote NFS client reaches the bug with no local access.\nAC:L - The attacker controls both sides: they keep a callback rpc_task on rpciod (e.g. NFS4ERR_DELAY so rpc_delay is 2s) and send DESTROY_SESSION. flush_workqueue does not wait for rpciod, and rpc_shutdown_client\u0027s 1s drain can expire first, so the window is attacker-driven and retryable.\nPR:N - Typical nfsd exports use AUTH_SYS/AUTH_NULL, so RPC identities are self-asserted. EXCHANGE_ID, CREATE_SESSION with a backchannel, OPEN, and DESTROY_SESSION succeed for any host allowed by the export; nfsd4_mach_creds_match is a no-op under default SP4_NONE. No local account is required.\nUI:N - The attacking NFS client issues CREATE_SESSION, OPEN/CB_RECALL traffic, NFS4ERR_DELAY replies, and DESTROY_SESSION itself. No victim on the server must mount a filesystem, open a file, or take any other action.\nS:U - The use-after-free corrupts a kmalloc\u0027d nfsd4_session in the host nfsd kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After free_session kfree\u0027s the session, rpciod still reads se_sessionid and se_cb_seq_nr in encode_cb_sequence4args and decode_cb_sequence4resok. Reclaim of that slab lets the attacker disclose kernel memory via the callback they receive. Per kernel guidance a UAF is C:H.\nI:H - The same dangling cl_cb_session is written by update_cb_slot_table (attacker-controlled target_highest_slotid), grab_slot/nfsd41_cb_release_slot (se_cb_slot_avail and se_lock), and nfsd4_cb_sequence_done (se_cb_seq_nr++). That is a UAF write primitive for heap corruption and control-flow hijack.\nA:H - Use-after-free of struct nfsd4_session from an rpciod callback oopses or panics the NFS server even without full exploitation, and the attacker can repeat DESTROY_SESSION against inflight callbacks to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:51:21.242Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76"
        },
        {
          "url": "https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"
        }
      ],
      "title": "nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89708",
    "datePublished": "2026-09-11T19:46:24.061Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-10-19T08:51:21.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89708\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:26:20.755207Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:26:21.286Z\"}}], \"cna\": {\"title\": \"nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The UAF is in nfsd NFSv4.1 session teardown (nfsd4_destroy_session) and the rpciod callback path (nfsd4_cb_sequence_done). DESTROY_SESSION and the inflight CB_COMPOUND run over TCP/2049, so a remote NFS client reaches the bug with no local access.\\nAC:L - The attacker controls both sides: they keep a callback rpc_task on rpciod (e.g. NFS4ERR_DELAY so rpc_delay is 2s) and send DESTROY_SESSION. flush_workqueue does not wait for rpciod, and rpc_shutdown_client\u0027s 1s drain can expire first, so the window is attacker-driven and retryable.\\nPR:N - Typical nfsd exports use AUTH_SYS/AUTH_NULL, so RPC identities are self-asserted. EXCHANGE_ID, CREATE_SESSION with a backchannel, OPEN, and DESTROY_SESSION succeed for any host allowed by the export; nfsd4_mach_creds_match is a no-op under default SP4_NONE. No local account is required.\\nUI:N - The attacking NFS client issues CREATE_SESSION, OPEN/CB_RECALL traffic, NFS4ERR_DELAY replies, and DESTROY_SESSION itself. No victim on the server must mount a filesystem, open a file, or take any other action.\\nS:U - The use-after-free corrupts a kmalloc\u0027d nfsd4_session in the host nfsd kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - After free_session kfree\u0027s the session, rpciod still reads se_sessionid and se_cb_seq_nr in encode_cb_sequence4args and decode_cb_sequence4resok. Reclaim of that slab lets the attacker disclose kernel memory via the callback they receive. Per kernel guidance a UAF is C:H.\\nI:H - The same dangling cl_cb_session is written by update_cb_slot_table (attacker-controlled target_highest_slotid), grab_slot/nfsd41_cb_release_slot (se_cb_slot_avail and se_lock), and nfsd4_cb_sequence_done (se_cb_seq_nr++). That is a UAF write primitive for heap corruption and control-flow hijack.\\nA:H - Use-after-free of struct nfsd4_session from an rpciod callback oopses or panics the NFS server even without full exploitation, and the attacker can repeat DESTROY_SESSION against inflight callbacks to deny service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dcbeaa68dbbdacbbb330a86c7fc95a28473fc209\", \"lessThan\": \"2775ec1d617e665eab71ce0f13ab1f7959713a2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcbeaa68dbbdacbbb330a86c7fc95a28473fc209\", \"lessThan\": \"f164eb52b6f3cbf40f07fe379f9f421f88e02f76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcbeaa68dbbdacbbb330a86c7fc95a28473fc209\", \"lessThan\": \"13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"dcbeaa68dbbdacbbb330a86c7fc95a28473fc209\", \"lessThan\": \"01c5d5f58a5db9b0ee5afba2e49d3157788687b2\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs4callback.c\", \"fs/nfsd/nfs4state.c\", \"fs/nfsd/state.h\", \"fs/nfsd/trace.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.38\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.38\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs4callback.c\", \"fs/nfsd/nfs4state.c\", \"fs/nfsd/state.h\", \"fs/nfsd/trace.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b\"}, {\"url\": \"https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76\"}, {\"url\": \"https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25\"}, {\"url\": \"https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\\n\\nAfter a DESTROY_SESSION the per-session teardown path can free a\\nsession while rpciod still holds an inflight callback rpc_task that\\ndereferences clp-\u003ecl_cb_session.  nfsd4_probe_callback_sync() flushes\\ncl_callback_wq, but once nfsd4_run_cb_work() has called\\nrpc_call_async() the rpc_task lives on rpciod; flushing the workqueue\\ndoes not wait for it.  rpc_shutdown_client() does drain rpciod tasks,\\nbut uses a 1-second wait_event_timeout \\u2014 tasks stuck in rpc_delay()\\n(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.\\n\\n    destroy path                       rpciod\\n    ------------                       ------\\n    unhash_session(ses)\\n    nfsd4_probe_callback_sync(clp)\\n      flush_workqueue(cl_callback_wq)\\n      /* returns; rpc_task still live */\\n    nfsd4_put_session_locked(ses)\\n    free_session(ses) -\u003e kfree(ses)\\n                                       nfsd4_cb_sequence_done()\\n                                         reads cb_clp-\u003ecl_cb_session\\n                                         /* freed slab */\\n\\nA second window exists in nfsd4_process_cb_update().  When\\n__nfsd4_find_backchannel() returns NULL because unhash_session() has\\nalready removed the destroyed session from cl_sessions,\\nsetup_callback_client() takes the v4.1 early return so\\nclp-\u003ecl_cb_session = ses never fires and the field retains a pointer\\nto the about-to-be-freed session.\\n\\nFix both by converting cl_cb_session to an RCU-protected pointer:\\n\\n  - Move the cl_cb_session = ses assignment in setup_callback_client()\\n    to after rpc_create() succeeds, so it is only published when a\\n    working backchannel exists.  Clear cl_cb_session on the error\\n    return in nfsd4_process_cb_update().  Both stores use\\n    rcu_assign_pointer().\\n\\n  - Annotate cl_cb_session with __rcu.  All rpciod-side readers use\\n    rcu_read_lock()/rcu_dereference() and check for NULL, bailing to\\n    the appropriate error or requeue path:\\n    encode_cb_sequence4args(), decode_cb_sequence4resok(),\\n    nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),\\n    nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().\\n\\n  - Switch __free_session() from kfree() to kfree_rcu() so the\\n    session slab is not reclaimed until after an RCU grace period,\\n    guaranteeing that rpciod readers inside rcu_read_lock() never\\n    dereference freed memory.\\n\\n  - Pass the session pointer to the nfsd_cb_seq_status and\\n    nfsd_cb_free_slot tracepoints instead of having them re-read\\n    cl_cb_session.\\n\\n  - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,\\n    routing through the done/release path to requeue the callback.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.111\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"2.6.38\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"2.6.38\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-19T08:51:21.242Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89708\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T08:51:21.242Z\", \"dateReserved\": \"2026-09-11T19:38:34.751Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:46:24.061Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.