9.8

CVE-2026-89494: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-89494DEBIAN-CVE-2026-89494
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89494 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.71%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11880-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation. num_locks and lockname_len are bounded only on the sending side, and the message is never checked to actually carry num_locks migratable_lock entries. As a result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the kmalloc(data_len) copy of the message (an out-of-bounds read that ends in a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). Both are reachable by any node in the domain. Validate these fields right after dlm_grab(), before anything uses them -- including the not-joined error path, which already prints mres->lockname with the unbounded lockname_len as a %.*s precision. Reject the message unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <= DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the payload is large enough to hold the claimed locks. Conforming recovery and migration messages are unaffected.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

+0.01 pp

From 0.70% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < 4a5798253212093b9ff7d90c6cfbe348bcda1594 | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < dce05b17db862f47ff60614017abe639b2e71cad | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < 0e999d56917f861f97adb961617b1828c9eb4733 | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < 77686fa5bba135252d348e2dacf481fc19f60c41 | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < f33041906885f96e190cde54e61ddc69de39e3ee | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < 50c4cc9183e11f83427efbf770f54851f4471c02 | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < a8facb1670b4a0612183198e758d9539ef628ed9 | ≥ 6714d8e86bf443f6f7af50f9d432025649f091f5, < b54e03d9b3697d25f4a0063cf717d459c5e3ad94 | 2.6.16

3 vendors · 172 products

References

12 links
Show all 12 references