Out-of-bounds write in Linux kernel - CVE-2026-89864
Published: September 17, 2026
Vulnerability identifier: #VU150421
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89864
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to corrupt kernel heap and stack memory.
The vulnerability exists due to improper bounds checking in the qla2x00_write_i2c() and qla2x00_read_i2c() I2C BSG handlers when processing a user-supplied I2C length. A local privileged user can submit a crafted I2C BSG request with an oversized length to corrupt kernel heap and stack memory.
Exploitation requires CAP_SYS_RAWIO.
Affected software
Linux kernel
How to mitigate CVE-2026-89864
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59
- https://git.kernel.org/stable/c/2be39946abcde5a6416fb074ef728429e246a996
- https://git.kernel.org/stable/c/32d6df14fdab71fe1ba304fd9a0db0411ea2e043
- https://git.kernel.org/stable/c/47049fdadc0eaa115e813735b827e1379c0d2cf8
- https://git.kernel.org/stable/c/522d6dcdc645d8f97d6b4cdfd6d8eea307f3ff0e
- https://git.kernel.org/stable/c/8f01f886cc5e7bbc16cbf1a9928fdebbc911e973
- https://git.kernel.org/stable/c/97ca58b0fb026799b99e3d552d5f69cf9a3113ad
- https://git.kernel.org/stable/c/9a756f277eb89f769dbf380f38245c270d31fdb5