Out-of-bounds read in Linux kernel - CVE-2026-89954
Published: September 17, 2026
Vulnerability identifier: #VU150336
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89954
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.
The vulnerability exists due to improper bounds checking in the AFS v2 parser when parsing a crafted AFS v2 image. A remote attacker can supply an image with a footer offset or region count that exceeds expected bounds to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.
Affected software
Linux kernel
How to mitigate CVE-2026-89954
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53
- https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4
- https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72
- https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348
- https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0
- https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7
- https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773
- https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7