Release of invalid pointer or reference in Linux kernel - CVE-2026-89992
Published: September 16, 2026
Vulnerability identifier: #VU150293
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89992
CWE-ID: CWE-763
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.
The vulnerability exists due to an invalid pointer release in the dt_idle_genpd cpuidle power-domain code when freeing an idle power-domain name. A remote attacker can trigger the release of a pointer to the basename rather than the original allocation to compromise confidentiality, integrity, and availability.
Affected software
Linux kernel
How to mitigate CVE-2026-89992
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/09d002c8fb0261d35ce9d8a705de5db034ee90b8
- https://git.kernel.org/stable/c/1312ae33b91430ec99e69cd3d47f0e50a4ebf54b
- https://git.kernel.org/stable/c/2b0ac85512b7f67479127b2713254490662eb13d
- https://git.kernel.org/stable/c/3394c7ba23336bdb7ece29127130fd01731d42d8
- https://git.kernel.org/stable/c/a38caa9ed0d5c61c17d88393b14b292199289c1f
- https://git.kernel.org/stable/c/b519dfce1998c323e54a56f911cf708d9ba0e076