CVE-2026-89818 (GCVE-0-2026-89818)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:30 – Updated: 2026-09-16 14:38
VLAI
Title
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 88411caee8f576d6b5abf6531232fcc0ce756dc5 , < c2340281be4ddacb8c203e2bce59b126d1d6c4c8 (git)
Affected: c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e , < 6dceaeceaa7c8396339f3ea34b0110cb912ca61b (git)
Affected: 7688143ca62edeecacb3ba0a2cea129dbd262a18 , < 47799e1f893d47d8af231710a61065e3ec8a13e8 (git)
Affected: 63b51e8a9d54317d31cc3856c1e12407070d5fc2 , < 7e28853c78c20bb8ba4c1dba702430cd05e09f76 (git)
Affected: b193019860d61e92da395eae2011f2f6716b182f , < 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3 (git)
Affected: b193019860d61e92da395eae2011f2f6716b182f , < 4d7390530853eb7befda9cc786e4c86e8ad7ac9e (git)
Affected: f55552adb100eb54a6e6dabff4fbdc8679bd3fa0 (git)
Affected: 82c535eff05490c71153af57de9fe85502fcb5d5 (git)
Affected: 638d3e0b9eb77aa53fdd60e2b928761d16ba76fa (git)
Affected: 870c8738c3774336baedddd0240951d078a703b8 (git)
Affected: 638e48ee39d0f2af9336f917a6f5d6692dd64d93 (git)
Affected: e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7 (git)
Affected: 3c817a60b09eaab926e475088e750936efcc95ae (git)
Affected: 6.1.175 , < 6.1.188 (semver)
Affected: 6.6.140 , < 6.6.157 (semver)
Affected: 6.12.90 , < 6.12.110 (semver)
Affected: 6.18.32 , < 6.18.51 (semver)
Affected: 5.15.209 , < 5.16 (semver)
Affected: 7.0.9 , < 7.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c",
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c2340281be4ddacb8c203e2bce59b126d1d6c4c8",
              "status": "affected",
              "version": "88411caee8f576d6b5abf6531232fcc0ce756dc5",
              "versionType": "git"
            },
            {
              "lessThan": "6dceaeceaa7c8396339f3ea34b0110cb912ca61b",
              "status": "affected",
              "version": "c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e",
              "versionType": "git"
            },
            {
              "lessThan": "47799e1f893d47d8af231710a61065e3ec8a13e8",
              "status": "affected",
              "version": "7688143ca62edeecacb3ba0a2cea129dbd262a18",
              "versionType": "git"
            },
            {
              "lessThan": "7e28853c78c20bb8ba4c1dba702430cd05e09f76",
              "status": "affected",
              "version": "63b51e8a9d54317d31cc3856c1e12407070d5fc2",
              "versionType": "git"
            },
            {
              "lessThan": "9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3",
              "status": "affected",
              "version": "b193019860d61e92da395eae2011f2f6716b182f",
              "versionType": "git"
            },
            {
              "lessThan": "4d7390530853eb7befda9cc786e4c86e8ad7ac9e",
              "status": "affected",
              "version": "b193019860d61e92da395eae2011f2f6716b182f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f55552adb100eb54a6e6dabff4fbdc8679bd3fa0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "82c535eff05490c71153af57de9fe85502fcb5d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "638d3e0b9eb77aa53fdd60e2b928761d16ba76fa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "870c8738c3774336baedddd0240951d078a703b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "638e48ee39d0f2af9336f917a6f5d6692dd64d93",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3c817a60b09eaab926e475088e750936efcc95ae",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.51",
              "status": "affected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c",
            "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.90",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.18.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.209",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check\n\nIf the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression\n6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting\nthe parser loop far past the end of the message BO. Triggering it\nadditionally requires a ~4GiB mapping so that msg[1] survives the\nearlier \"header does not fit in BO\" check.\n\nRewrite the test in division form, which is overflow-free by\nconstruction. Also update the message to reflect that msg is invalid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local DRM_IOCTL_AMDGPU_CS ioctl on /dev/dri/renderD* (amdgpu_cs_ioctl \u2192 amdgpu_cs_patch_jobs \u2192 amdgpu_cs_patch_ibs \u2192 vcn_v3/v4_0_ring_patch_cs_in_place \u2192 vcn_*_dec_msg). There is no network or physical path to the VCN decode-message parser.\nAC:L - The attacker fully controls the decode-message GEM BO. Setting num_buffers to 0x3FFFFFFF with a ~4GiB mapping makes 6+num_buffers*4 wrap to 2 so the uint32 bounds check passes deterministically; allocating that mapping is attacker-controlled on typical GPU workstations and cloud GPU hosts.\nPR:L - AMDGPU_CS is registered with DRM_AUTH|DRM_RENDER_ALLOW, so any unprivileged local user who can open the AMDGPU render node (typical render/video group on desktops, handhelds, Android, and GPU cloud instances) can submit VCN command buffers without root.\nUI:N - The attacker submits the crafted VCN command buffer through their own DRM context; no separate victim action such as opening a file or mounting a filesystem is required.\nS:U - The out-of-bounds read is performed by the CPU in the kernel kmap of the message BO and stays within the kernel security authority; it is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - Bypassing the buffer-count check lets the parser loop about 0x3FFFFFFF times, each step reading 16 bytes past the kmapped BO, an unbounded kernel out-of-bounds read well beyond a few bytes.\nI:N - The loop only reads message dwords and, when a CREATE record is seen, still bounds-checks offset/size against the BO before any further access; no out-of-bounds write or control-flow hijack primitive is produced.\nA:H - The unbounded walk past the kmapped BO into unmapped kernel or MMIO address space causes a page fault/oops, and the billion-iteration loop can also soft-lock the CS path before faulting."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:38:59.776Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c2340281be4ddacb8c203e2bce59b126d1d6c4c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dceaeceaa7c8396339f3ea34b0110cb912ca61b"
        },
        {
          "url": "https://git.kernel.org/stable/c/47799e1f893d47d8af231710a61065e3ec8a13e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e28853c78c20bb8ba4c1dba702430cd05e09f76"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d7390530853eb7befda9cc786e4c86e8ad7ac9e"
        }
      ],
      "title": "drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89818",
    "datePublished": "2026-09-16T10:30:50.946Z",
    "dateReserved": "2026-09-11T19:38:34.768Z",
    "dateUpdated": "2026-09-16T14:38:59.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89818",
      "date": "2026-09-25",
      "epss": "0.00167",
      "percentile": "0.05251"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T03:02:15.000Z",
      "cve": "CVE-2026-89818",
      "id": "msrc_CVE-2026-89818",
      "initial_release_date": "2026-09-17T01:03:28.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89818.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c",
                  "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c2340281be4ddacb8c203e2bce59b126d1d6c4c8",
                    "status": "affected",
                    "version": "88411caee8f576d6b5abf6531232fcc0ce756dc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6dceaeceaa7c8396339f3ea34b0110cb912ca61b",
                    "status": "affected",
                    "version": "c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47799e1f893d47d8af231710a61065e3ec8a13e8",
                    "status": "affected",
                    "version": "7688143ca62edeecacb3ba0a2cea129dbd262a18",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e28853c78c20bb8ba4c1dba702430cd05e09f76",
                    "status": "affected",
                    "version": "63b51e8a9d54317d31cc3856c1e12407070d5fc2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3",
                    "status": "affected",
                    "version": "b193019860d61e92da395eae2011f2f6716b182f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d7390530853eb7befda9cc786e4c86e8ad7ac9e",
                    "status": "affected",
                    "version": "b193019860d61e92da395eae2011f2f6716b182f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f55552adb100eb54a6e6dabff4fbdc8679bd3fa0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "82c535eff05490c71153af57de9fe85502fcb5d5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "638d3e0b9eb77aa53fdd60e2b928761d16ba76fa",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "870c8738c3774336baedddd0240951d078a703b8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "638e48ee39d0f2af9336f917a6f5d6692dd64d93",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "3c817a60b09eaab926e475088e750936efcc95ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.188",
                    "status": "affected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.110",
                    "status": "affected",
                    "version": "6.12.90",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.51",
                    "status": "affected",
                    "version": "6.18.32",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "7.0.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c",
                  "drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check\n\nIf the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression\n6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting\nthe parser loop far past the end of the message BO. Triggering it\nadditionally requires a ~4GiB mapping so that msg[1] survives the\nearlier \"header does not fit in BO\" check.\n\nRewrite the test in division form, which is overflow-free by\nconstruction. Also update the message to reflect that msg is invalid."
          }
        ],
        "id": "CVE-2026-89818",
        "lastModified": "2026-09-16T15:18:11.030",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:47.113",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47799e1f893d47d8af231710a61065e3ec8a13e8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d7390530853eb7befda9cc786e4c86e8ad7ac9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6dceaeceaa7c8396339f3ea34b0110cb912ca61b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e28853c78c20bb8ba4c1dba702430cd05e09f76"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c2340281be4ddacb8c203e2bce59b126d1d6c4c8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:44:53Z",
      "cve": "CVE-2026-89818",
      "id": "CVE-2026-89818",
      "initial_release_date": "2026-09-19T01:44:53Z",
      "product_status:known_affected": "67",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89818",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89818.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.