7

CVE-2026-89456: linux

CVSS: 7.0v3.1HighReceived
AliasesUBUNTU-CVE-2026-89456DEBIAN-CVE-2026-89456
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89456 is a high (CVSS 7.0) vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.0/10
010
High · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11805-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasd_default_erp_postaction() copies the timing and device state from the finished ERP request back to the original request but drops proc_bytes. A request that was partially completed, an ESE read of a not-yet-allocated track returns fewer bytes than requested, and then recovered through the ERP chain loses its partial-completion length. __dasd_cleanup_cqr() then sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read. Carry proc_bytes over to the original request like the other per-request state.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu165 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < 9e063165d3fe58db2a517717b830f17e82d03467 | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < 6b0954c8a259da1e4aa745989f82723947acfb46 | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < d0a2f97d8c97134aa7f6a191940b7bab4bb42f5f | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < f735b9710f0c8fe72c1060103e865f4ae678190b | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < d6b8778b1b82aa3a8dbf8612080f635b834bd16b | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < ceafb262475ac6cb3a7d07b1102608be2b216b99 | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < 15ec03452c18e8d288e519837d21b308300d74b2 | ≥ 5e6bdd37c5526ef01326df5dabb93011ee89237e, < 6fb5ba2e7e43173a3761e46f091070a8185efa14 | fbbacd0dcbc3ae9398c569dbea96ae4b5ad97e04 | 5f7c9989f11305aaa43e0f4378f4f070022a9f2b | ≥ 5.4.26, < 5.5 | ≥ 5.5.10, < 5.6 | 5.6

3 vendors · 168 products

References

12 links
Show all 12 references