Out-of-bounds read in Linux kernel - CVE-2026-89556
Published: September 12, 2026
Vulnerability identifier: #VU149246
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89556
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to access out-of-bounds memory.
The vulnerability exists due to improper validation of string table section header types in the Linux kernel module ELF validation routines when validating string table section headers in an ELF module. A local user can supply an ELF module with SHT_NULL or SHT_NOBITS string table section headers to access out-of-bounds memory.
Affected software
Linux kernel
How to mitigate CVE-2026-89556
Install security update from vendor's repository.