CVE-2026-89726: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Received
AliasesUBUNTU-CVE-2026-89726DEBIAN-CVE-2026-89726
Published 11-09-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-89726 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities.

Priority
Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
MGASA-2026-0506MGASA-2026-0542OPENSUSE-SU-2026:11880-1SUSE-SU-2026:4892-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 04ae68af4107600120c3c41c94268f43bc350d48 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2e5a70a175f0c74e7238b013a96c4eabc3002934 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3ada20e110bf3245edb0a3bcddadc33d0f142f8d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 60c74f42f5abddb85dd919b4448d5474e65dbe76 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 709eb41adaf78d59d4579a13a898125919b69bcc | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7d658da725ea81c91f73087547b97e7ced82d62b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1b0dc3cbb8630f0b5cb34d848628225920a904be | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < cec0d03fe785380540dc1b4d07c80f67ae2ffc78 | 2.6.12

3 vendors · 172 products

References

13 links
Show all 13 references