NULL pointer dereference in Linux kernel - CVE-2026-89460

Vulnerability identifier: #VU149356

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89460

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the s390 CPUMF performance monitoring unit when a CPU is added while a per-task CPUMF performance event is running. A local privileged user can trigger CPU hotplug during execution of a per-task performance event to cause a denial of service.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle (Ubuntu package)
linux-realtime (Ubuntu package)
linux-fips (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 6.8.0-147.147
linux-lowlatency (Ubuntu package) - update to 6.8.0-147.147.1
linux-gcp (Ubuntu package) - update to 6.8.0-1071.79
linux-aws (Ubuntu package) - update to 6.8.0-1067.70
linux-ibm (Ubuntu package) - update to 6.8.0-1067.68
linux-oracle (Ubuntu package) - update to 6.8.0-1064.67
linux-realtime (Ubuntu package) - update to 6.8.1-1062.63
linux-fips (Ubuntu package) - update to 6.8.0-147.147+fips1
linux-gkeop (Ubuntu package) - update to 6.8.0-1052.56
linux-gke (Ubuntu package) - update to 6.8.0-1066.74
linux-aws-fips (Ubuntu package) - update to 6.8.0-1067.70+fips1
linux-gcp-fips (Ubuntu package) - update to 6.8.0-1071.79+fips1
linux (Debian package) - update to 6.12.111-1

• https://git.kernel.org/stable/c/337bd95507a16063687cfc286ea90de5cca48c37
• https://git.kernel.org/stable/c/71d46de9153e067c63a15f3b00e6364e1c0230f8
• https://git.kernel.org/stable/c/777d040c2f91d8d929b4a32333dfe4102b27caea
• https://git.kernel.org/stable/c/dcce7a06ea690d5cf46a705a9b74cf0398ac091f

• NULL pointer dereference in Linux kernel s390 kernel
• Debian update for linux
• Ubuntu update for linux, linux-aws, linux-aws-fips and more