Use-after-free in Linux kernel - CVE-2026-89988
Published: September 16, 2026
Vulnerability identifier: #VU150306
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89988
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code, escalate privileges, disclose sensitive information, or cause a denial of service.
The vulnerability exists due to a use-after-free in the kprobe blacklist traversal function __within_kprobe_blacklist() when concurrently checking a kprobe blacklist entry during module unloading. A local user can trigger concurrent blacklist traversal and entry removal to dereference freed memory.
The blacklist traversal can occur in atomic or non-preemptible contexts.
Affected software
Linux kernel
How to mitigate CVE-2026-89988
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0c4256196b3a105307e2235fbfd85e768bbcdd0f
- https://git.kernel.org/stable/c/518d9b5568bb06f86e4434f7a30faa9612ea91ad
- https://git.kernel.org/stable/c/5da247e4d1e8661d4d6f997101d59967e8994e32
- https://git.kernel.org/stable/c/630ed8734a02b992e8a97538179c2ece42c5210f
- https://git.kernel.org/stable/c/6e62cf983a2bd547e6bbd3f935539233e5f97f8f
- https://git.kernel.org/stable/c/8f406205003f741225f620f0e357ca0de71d45e3