Out-of-bounds write in Linux kernel - CVE-2026-89904

Vulnerability identifier: #VU150380

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-89904

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the acpi_package_ids[] array when processing a PPTT ACPI table on a LoongArch virtual machine. A remote attacker can trigger the array overflow to cause memory corruption.

The issue can occur on LoongArch virtual machines configured with one core per socket.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
linux (Debian package) - update to 6.12.111-1

• https://git.kernel.org/stable/c/0195e04b1eec8fb00e2db9c5e55655a3f5e76f60
• https://git.kernel.org/stable/c/2a2367d46d7a4ee4122b7a86e57125542dbbe963
• https://git.kernel.org/stable/c/6311b8c471afa33c18adbe4eb16f862936b71ca3
• https://git.kernel.org/stable/c/d3fd094c13c6d0b74f246461ca4cf427d539c8e8

• Out-of-bounds write in Linux kernel loongarch kernel
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more