CVE-2026-89754
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A flaw in the Linux kernel's mm/pagewalk mechanism causes walk->action to remain incorrectly set to ACTION_AGAIN after a PMD entry is cleared, leading to duplicate walk callbacks and an out-of-bounds write. This was detected by KASAN in __mincore_unmapped_range.
Risk Assessment
A local attacker could exploit this vulnerability to corrupt kernel memory, potentially causing a system crash (denial of service) or possibly privilege escalation. Systems running an affected Linux kernel version are at risk.
Recommendation
Immediately update the Linux kernel to a version containing the fix (the patching commit). If immediate update is not possible, consider restricting local access to untrusted users.
Other vulnerabilities in Linux kernel
See all- CVE-2026-98162Unknown
In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.
- CVE-2026-98160Unknown
In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.
- CVE-2026-100079Unknown
In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.
- CVE-2026-100078Unknown
In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.
- CVE-2026-100077Unknown
In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.
- CVE-2026-100074Unknown
In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.
- CVE-2026-100073Unknown
In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.
- CVE-2026-100072Unknown
In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.
- CVE-2026-100071Unknown
In the Linux kernel, a memory leak in the HSR (High-availability Seamless Redundancy) module was fixed. When hsr_dev_finalize() fails after registering an RX handler, dynamic nodes learned in that window are not released. The fix frees both dynamic databases in the error unwind path.
- CVE-2026-100070Unknown
In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk->ops->install_pte is not specified, the code continues to the next PMD entry in the range without resetting walk->action to ACTION_SUBTREE. This leaves walk->action erroneously set to ACTION_AGAIN, which is incorrect. This was incorrect but not problematic up until commit 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault") which updated walk_pud_range() to check for walk->action == ACTION_AGAIN upon walk_pmd_range()'s return, causing the PUD walk to be retried. In this case this results in duplicate walk callbacks being invoked, which is erroneous and will break any caller that is not idempotent with respect to this (and waste time for those which are). The result is an out-of-bounds write, triggered by a local fuzzer: [ 2.272695] ================================================================== [ 2.273471] BUG: KASAN: slab-out-of-bounds in __mincore_unmapped_range+0x14f/0x190 [ 2.274302] Write of size 1 at addr ffff888008d9b000 by task poc/106 [ 2.274966] [ 2.275154] CPU: 0 UID: 1000 PID: 106 Comm: poc Not tainted 7.2.0-rc6-00429-ga7c7074b58d2 #55 PREEMPT(lazy) [ 2.275159] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.275164] Call Trace: [ 2.275170] <TASK> [ 2.275172] dump_stack_lvl+0x53/0x70 [ 2.275200] print_report+0xd0/0x630 [ 2.275210] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.275219] ? irqentry_exit+0xd2/0x670 [ 2.275224] ? irqentry_exit+0xd2/0x670 [ 2.275226] ? __virt_addr_valid+0xef/0x1a0 [ 2.275239] ? __mincore_unmapped_range+0x14f/0x190 [ 2.275242] kasan_report+0xce/0x100 [ 2.275245] ? __mincore_unmapped_range+0x14f/0x190 [ 2.275248] __mincore_unmapped_range+0x14f/0x190 [ 2.275252] mincore_unmapped_range+0x45/0x70 [ 2.275254] walk_pgd_range+0xafc/0xfc0 [ 2.275261] ? __pfx_walk_pgd_range+0x10/0x10 [ 2.275264] ? __update_load_avg_se+0x3d1/0x670 [ 2.275275] __walk_page_range+0xc0/0x310 [ 2.275278] ? __pfx_find_vma+0x10/0x10 [ 2.275281] ? finish_task_switch.isra.0+0x16d/0x4f0 [ 2.275290] walk_page_range_mm_unsafe+0x26f/0x3a0 [ 2.275293] ? __pfx_mtree_load+0x10/0x10 [ 2.275298] ? __pfx_walk_page_range_mm_unsafe+0x10/0x10 [ 2.275302] ? __free_frozen_pages+0x54d/0x7e0 [ 2.275308] __do_sys_mincore+0x132/0x380 [ 2.275311] do_syscall_64+0xf9/0x540 [ 2.275316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2.275322] RIP: 0033:0x422ccd [ 2.275326] Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 2.275329] RSP: 002b:00007fffffffec18 EFLAGS: 00000287 ORIG_RAX: 000000000000001b [ 2.275337] RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000422ccd [ 2.275339] RDX: 00000000004d0940 RSI: 0000000001000000 RDI: 00007ffff4000000 [ 2.275340] RBP: 00000000004d0940 R08: 0000000000000100 R09: 0000000000000100 [ 2.275342] R10: 0000000000000100 R11: 0000000000000287 R12: 20c49ba5e353f7cf [ 2.275343] R13: 00000000004990d3 R14: 0000000000000000 R15: 0000000000000001 [ 2.275346] </TASK> [ 2.275347] [ 2.296904] The buggy address belongs to the object at ffff888008d9b000 [ 2.296904] which belongs to the cache sigqueue of size 80 [ 2.298151] The buggy address is located 0 bytes inside of [ 2.298151] allocated 80-byte region [ffff888008d9b000, ffff888008d9b050) [ 2.299408] [ 2.299601] The buggy address belongs to the physical page: [ 2.300191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8d9b ---truncated---
Vulnerability data from NVD (NIST) · CISA KEV · EPSS