Debian live-boot CVE-2026-89169

Q: What is the CVSS score of CVE-2026-89169?

CVE-2026-89169 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-75949 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-09-11 mitre

GHSA-7rv3-47f7-55fq

Debian Live Boot

4.1

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Physical access required (AV:P); AC:H for the specific precondition of .verity file absence; integrity-only impact with no confidentiality or availability effect.

3.1 AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 11, 2026 - 05:40 vuln.today

tag: Authentication Bypass removed

Metadata Corrected

Sep 11, 2026 - 05:40 vuln.today

tag: Jwt Attack removed

Analysis Generated

Sep 11, 2026 - 05:31 vuln.today

DescriptionCVE.org

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

AnalysisAI

live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Physical access to the target system or to the live medium (AV:P) is required before boot. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is low-to-moderate and highly constrained. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary advisory is the Debian bug report at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146422; monitor it for a patched package release. … Detailed patch versions, workarounds, and compensating controls in full report.