CVE-2026-89989

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the buffer. validate_hash_algo() passes the result straight to integrity_audit_msg() without checking. ERR_PTR is not NULL, so integrity_audit_message() sees a valid pointer and calls strlen() on it, which faults:

BUG: unable to handle page fault for address: ffffffffffffffdc RIP: 0010:strlen+0x30/0xa0 Call Trace: audit_log_untrustedstring+0x19/0x30 integrity_audit_message+0x366/0x4f0 ima_inode_setxattr+0x512/0x5f0

Check for IS_ERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < d6fade89903c8fd0af6c956242aec8b927040e02; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < 0de5b525c0cd7d202848b8adfde3c01c287fb1a6; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < 30b5c0e17dcad72b6b2f987319aa645570e6376d; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < 9e69d683ebd7def04557fe758ff123105d7d9840; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < f8a2f2a4602318eb93d49d27fd0d0fdaab17edde; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < d62a84a78de5f29c642fa3bd4eee072ba7289cb4; >= 4f2946aa0c45c78b4f4ef101bab9694e38c68db0, < 8861f6d5c0678a7c5089c7b272509fc5931b8437
LinuxLinux5.15

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-899909.8In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling CVE-2026-89991In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpu_freelist push with one possible CPU __pCVE-2026-899928.4In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree() the original name allocation dt_idle_pCVE-2026-89993In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dw_edmaCVE-2026-899947.8In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output TheCVE-2026-899958.8In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() CommiCVE-2026-89996In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds DMACVE-2026-899977.8In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and CVE-2026-899987.8In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace callsCVE-2026-899998.1In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_iCVE-2026-900008.8In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driveCVE-2026-900017.8In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in struct_ops destroy path
CVE-2026-89989: Unscored | Vulnix