CVE-2026-89552
In the Linux kernel, the following vulnerability has been resolved:
params: fix charp corruption on allocation failure
param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated.
The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL.
Failing zswap's compressor update before zswap is initialized can later trigger:
Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.
Detalles técnicos trazas, registros y código del informe original
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:strcmp+0x10/0x30
Call Trace:
zswap_setup+0x3b1/0x490
zswap_enabled_param_set+0x5b/0xa0
param_attr_store+0x93/0xe0
module_attr_store+0x1c/0x30
kernfs_fop_write_iter+0x116/0x1f0CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-89552",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e180a6b7759a99a28cbcce3547c4c80822cb6c2a",
"lessThan": "614f873268c5b172804c9af6639bd17b7e1e2359",
"versionType": "git"
},
{
"status": "affected",
"version": "e180a6b7759a99a28cbcce3547c4c80822cb6c2a",
"lessThan": "704ecd010d4a9b33160e40b74eb402f6b86a18e0",
"versionType": "git"
},
{
"status": "affected",
"version": "e180a6b7759a99a28cbcce3547c4c80822cb6c2a",
"lessThan": "0d8e2404925a0607ffec79a53170715a46936896",
"versionType": "git"
},
{
"status": "affected",
"version": "e180a6b7759a99a28cbcce3547c4c80822cb6c2a",
"lessThan": "3dfaae04243cde460d82dfc2a7dd0bb6664d20ae",
"versionType": "git"
}
],
"programFiles": [
"kernel/params.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.30",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/params.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-11T20:19:38.760",
"references": [
{
"url": "https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparams: fix charp corruption on allocation failure\n\nparam_set_charp() stores charp parameters in allocated memory after slab is\navailable, and releases the previous value when the parameter is updated.\n\nThe previous value is released before the replacement allocation succeeds.\nIf kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter\nleft as NULL.\n\nFailing zswap's compressor update before zswap is initialized can later\ntrigger:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:strcmp+0x10/0x30\n Call Trace:\n zswap_setup+0x3b1/0x490\n zswap_enabled_param_set+0x5b/0xa0\n param_attr_store+0x93/0xe0\n module_attr_store+0x1c/0x30\n kernfs_fop_write_iter+0x116/0x1f0\n\nAllocate and copy the replacement first, then replace the parameter value\nonly after allocation succeeds."
}
],
"lastModified": "2026-09-11T20:19:38.760",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}