9.8

CVE-2026-89485: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-89485DEBIAN-CVE-2026-89485
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89485 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.71%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 10
OPENSUSE-SU-2026:11880-1OPENSUSE-SU-2026:22091-1SUSE-SU-2026:24179-1SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1SUSE-SU-2026:24184-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

+0.01 pp

From 0.70% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < e3c413f789eaf0170275c7eba523ead73d963f30 | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < 08a455f87b14c7ff22ae3fdadda62a796a3a5572 | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < 550c19222c7132c888e23c9d89079ba1c9bc4cca | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < 350087f231c11efcd288c310707c40eab63ca583 | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < c24bdb7df2f34bdc38ca8a73796f5acb40f1830c | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < 41f0a6d31615fcae261bf28a0aa50050dc93a401 | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < e999a88133654c6dfc68487fb49da5f20dfa2d4f | ≥ 01df9c5e918ae5559f2d96da0143f8bfbb9e6171, < 526c49cff3f72c3ec74752016380c7567040581b | 2.6.18

3 vendors · 172 products

References

13 links
Show all 13 references