« Volver al listado

CVE-2026-89989

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the buffer. validate_hash_algo() passes the result straight to integrity_audit_msg() without checking. ERR_PTR is not NULL, so integrity_audit_message() sees a valid pointer and calls strlen() on it, which faults:

Check for IS_ERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing.

Detalles técnicos trazas, registros y código del informe original
    BUG: unable to handle page fault for address: ffffffffffffffdc
    RIP: 0010:strlen+0x30/0xa0
    Call Trace:
     audit_log_untrustedstring+0x19/0x30
     integrity_audit_message+0x366/0x4f0
     ima_inode_setxattr+0x512/0x5f0

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89989",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "d6fade89903c8fd0af6c956242aec8b927040e02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "0de5b525c0cd7d202848b8adfde3c01c287fb1a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "30b5c0e17dcad72b6b2f987319aa645570e6376d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "9e69d683ebd7def04557fe758ff123105d7d9840",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "f8a2f2a4602318eb93d49d27fd0d0fdaab17edde",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "d62a84a78de5f29c642fa3bd4eee072ba7289cb4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2946aa0c45c78b4f4ef101bab9694e38c68db0",
              "lessThan": "8861f6d5c0678a7c5089c7b272509fc5931b8437",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:17:10.010",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0de5b525c0cd7d202848b8adfde3c01c287fb1a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/30b5c0e17dcad72b6b2f987319aa645570e6376d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8861f6d5c0678a7c5089c7b272509fc5931b8437",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9e69d683ebd7def04557fe758ff123105d7d9840",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d62a84a78de5f29c642fa3bd4eee072ba7289cb4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d6fade89903c8fd0af6c956242aec8b927040e02",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8a2f2a4602318eb93d49d27fd0d0fdaab17edde",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Check for ERR_PTR from dentry_path() in validate_hash_algo()\n\ndentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the\nbuffer. validate_hash_algo() passes the result straight to\nintegrity_audit_msg() without checking. ERR_PTR is not NULL, so\nintegrity_audit_message() sees a valid pointer and calls strlen() on\nit, which faults:\n\n    BUG: unable to handle page fault for address: ffffffffffffffdc\n    RIP: 0010:strlen+0x30/0xa0\n    Call Trace:\n     audit_log_untrustedstring+0x19/0x30\n     integrity_audit_message+0x366/0x4f0\n     ima_inode_setxattr+0x512/0x5f0\n\nCheck for IS_ERR() and use NULL instead, which makes the audit message\nskip the name= field instead of crashing."
    }
  ],
  "lastModified": "2026-09-16T11:17:10.010",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}