Heap-based buffer overflow in Linux kernel - CVE-2026-89575

Vulnerability details

The vulnerability allows a local privileged user to cause a heap-based buffer overflow.

The vulnerability exists due to improper buffer size calculation in build_constructor_string() when formatting a maximum-length u64 value. A local privileged user can cause sprintf() to write a terminating NUL byte beyond the allocated buffer space to cause a heap-based buffer overflow.

Affected software

How to mitigate CVE-2026-89575

External References

• https://git.kernel.org/stable/c/0a3657ebd6b517b60cdc5123894047616974e25b
• https://git.kernel.org/stable/c/644140527ae494cedf3b5c0ecd16287deaea7a66
• https://git.kernel.org/stable/c/73c37fe54cd056d07461b142ab0b8b81e1ef6ad8
• https://git.kernel.org/stable/c/f79b53ca3a68a46c6fc3b30b148d1dfb1b33ea8b

Related Security Bulletins

• Heap-based buffer overflow in Linux kernel md driver