Use of Uninitialized Variable in Linux kernel - CVE-2026-89921
Published: September 17, 2026
Vulnerability identifier: #VU150360
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89921
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of uninitialized stack data structures in __kvm_inject_pfault_token() when using migration ioctls after page-fault token injection. A local user can retrieve stale stack values to disclose sensitive information.
The stale values are not exposed to the guest through interrupt delivery.
Affected software
Linux kernel
How to mitigate CVE-2026-89921
Install security update from vendor's repository.