CVE-2026-89713 (GCVE-0-2026-89713)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-21 12:48
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the file size sampled by that unlocked read, but the actual ATTR_SIZE update is applied later under inode_lock() by notify_change(). This leaves a TOCTOU window for append-only files. If a client sends a SETATTR that does not shrink the file at the time of the unlocked sample, a concurrent append can extend the file before nfsd_setattr() takes inode_lock(). notify_change() then applies a real truncation without the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS truncate syscall paths perform their own append-only checks before calling notify_change(), so NFSD must make this decision against the locked size it is about to change. Split the write-count acquisition from the truncation permission check. Keep get_write_access() before the locked setattr work, then recheck whether the requested size is below i_size_read(inode) after inode_lock() has been acquired and before notify_change(ATTR_SIZE). This also avoids the plain unlocked inode->i_size load.
References
Impacted products
Vendor Product Version
Linux Linux Version: 783112f7401ff449d979530209b3f6c2594fdb4e
Version: 783112f7401ff449d979530209b3f6c2594fdb4e
Version: 783112f7401ff449d979530209b3f6c2594fdb4e
Version: 783112f7401ff449d979530209b3f6c2594fdb4e
Version: 783112f7401ff449d979530209b3f6c2594fdb4e
Version: 604a3c407026d6162d15300478e63f901e435efc
Version: cc4d5dc73841b98d33cdfb9822d70b0aac4beca5
Version: 3ee4f442e5b37a537297b812557b1163f96b5399
Version: a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44
Version: 982898d7f97a35447403c3fcecc0d96c646ce101
Version: 3.2.89   ≤
Version: 3.16.44   ≤
Version: 4.4.53   ≤
Version: 4.9.14   ≤
Version: 4.10.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:26:29.958634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:36:59.626Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52d0c5bdfe232c9974d4b11f97078b9c7814f05d",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "3afa17d93ba8c925f49370c816c6dae5112d8c24",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "d8352da196349182e1afd5a93308256cddc0a97d",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "44086254479035de42ca3d286ecf25521d4e6325",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "lessThan": "b778e0e0a16759f22a70579c3cf8d254a40d4a7f",
              "status": "affected",
              "version": "783112f7401ff449d979530209b3f6c2594fdb4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "604a3c407026d6162d15300478e63f901e435efc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cc4d5dc73841b98d33cdfb9822d70b0aac4beca5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ee4f442e5b37a537297b812557b1163f96b5399",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982898d7f97a35447403c3fcecc0d96c646ce101",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.89",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.53",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.14",
              "versionType": "semver"
            },
            {
              "lessThan": "4.11",
              "status": "affected",
              "version": "4.10.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.89",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.10.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: check truncate permission under inode lock\n\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\nbefore it takes inode_lock(). The comparison uses the file size sampled\nby that unlocked read, but the actual ATTR_SIZE update is applied later\nunder inode_lock() by notify_change().\n\nThis leaves a TOCTOU window for append-only files. If a client sends a\nSETATTR that does not shrink the file at the time of the unlocked\nsample, a concurrent append can extend the file before nfsd_setattr()\ntakes inode_lock(). notify_change() then applies a real truncation\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\ntruncate syscall paths perform their own append-only checks before\ncalling notify_change(), so NFSD must make this decision against the\nlocked size it is about to change.\n\nSplit the write-count acquisition from the truncation permission check.\nKeep get_write_access() before the locked setattr work, then recheck\nwhether the requested size is below i_size_read(inode) after inode_lock()\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\nthe plain unlocked inode-\u003ei_size load."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.\nAC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.\nPR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner\u0027s uid.\nUI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.\nS:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.\nC:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.\nI:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.\nA:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:27.026Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d"
        },
        {
          "url": "https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325"
        },
        {
          "url": "https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f"
        }
      ],
      "title": "NFSD: check truncate permission under inode lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89713",
    "datePublished": "2026-09-11T19:46:27.752Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-10-21T12:48:27.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89713\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:26:29.958634Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:26:30.995Z\"}}], \"cna\": {\"title\": \"NFSD: check truncate permission under inode lock\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - nfsd_setattr() is reached from in-kernel nfsd NFSv2/v3 SETATTR and NFSv4 SETATTR (including ONE_STATEID) over TCP/UDP 2049, so a remote client triggers the TOCTOU without local shell access.\\nAC:L - The attacker drives both sides of the race by issuing concurrent SETATTR size RPCs, or racing SETATTR against O_APPEND writes they perform themselves; a non-shrinking unlocked i_size sample then becomes a real truncate under inode_lock. No victim-only layout is required.\\nPR:N - Default nfsd exports accept AUTH_SYS and AUTH_NULL with no cryptographic authentication, so the client asserts uid/gid. ATTR_SIZE uses fh_verify(NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE), which is satisfied by spoofing the file owner\u0027s uid.\\nUI:N - The attacking NFS client sends SETATTR itself. No administrator or end-user action on the server is required beyond nfsd already serving a writable export.\\nS:U - The skipped IS_APPEND check and the resulting notify_change(ATTR_SIZE) truncate affect only the exported filesystem in the same kernel security authority as nfsd. This is not a VM, IOMMU, or sandbox escape.\\nC:N - The bug only omits NFSD_MAY_TRUNC for IS_APPEND before a locked size update. It does not read kernel memory, leak pointers, or disclose file contents beyond ordinary authorized NFS access.\\nI:H - Winning the TOCTOU lets notify_change() apply ATTR_SIZE to an IS_APPEND inode, bypassing the append-only truncation ban that VFS truncate/ftruncate enforce, so a remote client can destroy data that chattr +a is meant to keep immutable, including concurrent log and audit appends.\\nA:H - Unauthorized truncation of append-only operational logs, databases, or other files that services depend on can persistently destroy that live content and deny use of it until restored, and the attacker can repeat the race at will against further files.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"783112f7401ff449d979530209b3f6c2594fdb4e\", \"lessThan\": \"52d0c5bdfe232c9974d4b11f97078b9c7814f05d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"783112f7401ff449d979530209b3f6c2594fdb4e\", \"lessThan\": \"3afa17d93ba8c925f49370c816c6dae5112d8c24\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"783112f7401ff449d979530209b3f6c2594fdb4e\", \"lessThan\": \"d8352da196349182e1afd5a93308256cddc0a97d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"783112f7401ff449d979530209b3f6c2594fdb4e\", \"lessThan\": \"44086254479035de42ca3d286ecf25521d4e6325\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"783112f7401ff449d979530209b3f6c2594fdb4e\", \"lessThan\": \"b778e0e0a16759f22a70579c3cf8d254a40d4a7f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604a3c407026d6162d15300478e63f901e435efc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc4d5dc73841b98d33cdfb9822d70b0aac4beca5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3ee4f442e5b37a537297b812557b1163f96b5399\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a3c6cbc4eac4473ed5461d5faae2794d3e5c0e44\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"982898d7f97a35447403c3fcecc0d96c646ce101\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.2.89\", \"lessThan\": \"3.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.16.44\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.4.53\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.14\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.10.2\", \"lessThan\": \"4.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/nfsd/vfs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/vfs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/52d0c5bdfe232c9974d4b11f97078b9c7814f05d\"}, {\"url\": \"https://git.kernel.org/stable/c/3afa17d93ba8c925f49370c816c6dae5112d8c24\"}, {\"url\": \"https://git.kernel.org/stable/c/d8352da196349182e1afd5a93308256cddc0a97d\"}, {\"url\": \"https://git.kernel.org/stable/c/44086254479035de42ca3d286ecf25521d4e6325\"}, {\"url\": \"https://git.kernel.org/stable/c/b778e0e0a16759f22a70579c3cf8d254a40d4a7f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSD: check truncate permission under inode lock\\n\\nnfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC\\nbefore it takes inode_lock(). The comparison uses the file size sampled\\nby that unlocked read, but the actual ATTR_SIZE update is applied later\\nunder inode_lock() by notify_change().\\n\\nThis leaves a TOCTOU window for append-only files. If a client sends a\\nSETATTR that does not shrink the file at the time of the unlocked\\nsample, a concurrent append can extend the file before nfsd_setattr()\\ntakes inode_lock(). notify_change() then applies a real truncation\\nwithout the NFSD_MAY_TRUNC check that rejects IS_APPEND(inode). The VFS\\ntruncate syscall paths perform their own append-only checks before\\ncalling notify_change(), so NFSD must make this decision against the\\nlocked size it is about to change.\\n\\nSplit the write-count acquisition from the truncation permission check.\\nKeep get_write_access() before the locked setattr work, then recheck\\nwhether the requested size is below i_size_read(inode) after inode_lock()\\nhas been acquired and before notify_change(ATTR_SIZE). This also avoids\\nthe plain unlocked inode-\u003ei_size load.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.109\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.2.89\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.44\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.53\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.10.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-21T12:48:27.026Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89713\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T12:48:27.026Z\", \"dateReserved\": \"2026-09-11T19:38:34.751Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:46:27.752Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.