EUVD-2026-86978
GHSA-235g-f6jm-cm7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal low-privilege shell access
-
DeliveryInvoke printk kthread-creation path
-
ExploitDeliver SIGKILL causing -EINTR
-
ExecutionWARN_ON assertion fires
-
ImpactAvailability impact (splat / panic if panic_on_warn)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires local access with the ability to drive a printk code path that calls kthread_run and to deliver a SIGKILL so __kthread_create_on_node() returns -EINTR, per the description. Limiting factors: exploitation is local only (AV:L) and needs low privileges (PR:L) sufficient to reach the path and signal the process; no remote vector and no user interaction. The severity of the outcome is further gated by configuration - a WARN_ON only yields a hard denial of service on kernels built/booted with panic_on_warn enabled, which is non-default; the available sources do not describe the downstream impact beyond the warning. |
| Impact | This is a low-to-moderate priority issue despite the A:H impact flag. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-reachable, low-privilege availability defect with no confidentiality or integrity impact, which is consistent with the CWE-617 (reachable assertion) classification and the description: a WARN_ON() in the printk kthread-creation path fires when __kthread_create_on_node() returns -EINTR after a SIGKILL. EPSS is very low (0.14%, 3rd percentile) and the vulnerability is NOT in CISA KEV, with no public exploit identified, so there is no signal of real-world exploitation - these signals agree with each other and with the vuln.today 'this_month' decision label (routine, not act_now/emergency). CONFLICT/CAVEAT to verify: the A:H rating implies a denial of service, but a bare WARN_ON typically only emits a splat and does not crash the kernel unless panic_on_warn is configured; the available sources do not describe the end impact, so whether this is a true DoS or merely a spurious warning is not confirmed. Also note the 'Information Disclosure' tag contradicts the C:N vector and CWE-617 - treat the tag as suspect. Overall: a legitimate correctness/robustness fix worth patching on a normal cycle, not an emergency. |
| Exploit ScenarioDerived | A local, low-privileged user triggers a code path that causes printk to spawn a kthread, then delivers a SIGKILL so kthread creation returns -EINTR, tripping the WARN_ON(). On a system configured with panic_on_warn this could escalate the warning into a kernel panic (denial of service); otherwise it produces a kernel warning splat. No public exploit code was identified in the provided data, and the exact trigger path is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
The Linux kernel's printk code path can be pushed into a WARN_ON() when kthread_run() fails, because __kthread_create_on_node() returns -EINTR once the target is killed with SIGKILL; a local user who can reach that printk path and signal the kthread can therefore force a kernel warning. Because the outcome is gated by configuration, the practical impact is a denial of service only on kernels built or booted with panic_on_warn enabled, where the warning escalates to a panic. Scoring is low-risk (EPSS 0.14%, third percentile, no CISA KEV entry) and no public exploit has been identified at time of analysis; vendor fixes are available via the kernel stable tree.
RemediationAI
Vendor-released patch: Linux 7.2.7 and 7.3-rc3, plus the corresponding 6.12 stable backport; upgrade to those or later releases, applying the stable-tree commits 4e676279798148382497d0e38c0bd51115e64be1, 72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d, 0af43b52fe4b1751b731c067127fdf47cf1b700c and 15ba35d632c38d879d182577b0af487de0f2dec4 where a full version jump is not possible (advisories: https://git.kernel.org/stable/c/0af43b52fe4b1751b731c067127fdf47cf1b700c, https://nvd.nist.gov/vuln/detail/CVE-2026-98147, https://vuldb.com/vuln/409990). Until the kernel is updated, the single most effective compensating control is to ensure panic_on_warn is not enabled (kernel.panic_on_warn=0), since the denial-of-service outcome depends entirely on that setting escalating the warning into a panic; the trade-off is that operators who rely on panic_on_warn for crash-dump capture or fast failover lose that diagnostic and recovery behaviour. Exposure is local-only and needs a low-privileged user capable of reaching the affected printk path, so restricting interactive or service accounts on sensitive hosts reduces reachability, at the cost of reduced operational flexibility. Note that these are partial mitigations; the vendor's fixed kernel remains the complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the kernel's printk subsystem, which spawns helper threads with kthread_run(). When the underlying __kthread_create_on_node() is interrupted by a SIGKILL delivered to the creating task, it returns -EINTR rather than a fatal error, but the call site treats any failure as an invariant violation and emits WARN_ON(). This maps to CWE-617 (Reachable Assertion): a condition that is expected and recoverable under normal signal handling is asserted as impossible, converting a benign failure into a kernel warning/oops path. The provided sources do not describe any further downstream corruption beyond the warning itself, and they do not describe the exact context in which an unprivileged local task can reach the affected printk path and signal the kthread; that trigger detail is not described in the available sources. CPE data (cpe:2.3:a:linux:linux) confirms the Linux kernel itself is the affected component. The severity flagged as A:H derives from the warning reaching panic_on_warn, a non-default configuration, rather than from memory corruption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local trigger from a low-privileged context reaching the printk kthread path (AV:L/PR:L/AC:L); availability-only impact from the assertion, no confidentiality or integrity effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
printk: Don't WARN on kthread_run failure.
Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB