EUVD-2026-80596
GHSA-8536-v82h-gp8m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local timing race (AV:L/AC:H); kprobe registration plus module load/unload require root-level privilege (PR:H); freed-memory deref yields crash-dominant DoS (A:H) with minor integrity corruption (I:L) and no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Protect kprobe_blacklist with RCU
__within_kprobe_blacklist() traverses kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, kprobe_remove_area_blacklist() removes blacklist entries and immediately frees them with kfree(). A concurrent call to within_kprobe_blacklist() can therefore dereference freed memory.
Furthermore, within_kprobe_blacklist() can be called in atomic or non-preemptible contexts where the sleeping kprobe_mutex cannot be taken.
Protect kprobe_blacklist with RCU. Use guard(rcu)() and list_for_each_entry_rcu() for traversal, list_add_tail_rcu() for insertions, list_del_rcu() for deletions, and kfree_rcu() to reclaim entries safely after a grace period.
AnalysisAI
A use-after-free race condition in the Linux kernel kprobes subsystem (CVE-2026-89988) lets a highly privileged local actor corrupt kernel memory by racing a blacklist traversal against a concurrent kernel module unload. Specifically, __within_kprobe_blacklist() walks kprobe_blacklist without holding kprobe_mutex, while kprobe_remove_area_blacklist() unlinks and immediately kfree()s those same entries when a module is unloaded, so a traversal that lands in the race window dereferences freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access with the ability to register kprobes (root / CAP_SYS_MODULE / CAP_SYS_ADMIN or debugfs kprobe interface) AND the ability to load/unload a kernel module that contributes kprobe_blacklist entries, since kprobe_remove_area_blacklist() frees those entries on unload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free race condition (CWE-416/362) in the Linux kernel kprobes subsystem, not the 'Information Disclosure' its tag implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upstream Linux stable releases 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2 (or later) contain the RCU conversion for kprobe_blacklist; apply the corresponding stable commit for your branch - 8f406205003f741225f620f0e357ca0de71d45e3, 630ed8734a02b992e8a97538179c2ece42c5210f, 518d9b5568bb06f86e4434f7a30faa9612ea91ad, 5da247e4d1e8661d4d6f997101d59967e8994e32, 6e62cf983a2bd547e6bbd3f935539233e5f97f8f or 0c4256196b3a105307e2235fbfd85e768bbcdd0f - all linked from https://git.kernel.org/stable/ and tracked under https://nvd.nist.gov/vuln/detail/CVE-2026-89988. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts, containers, and managed endpoints that may run affected kernel versions; confirm whether the vendor advisory for CVE-2026-89988 lists a fixed kernel package, and if so schedule emergency updates for internet-facing and business-critical systems while restricting debugfs/kprobe access to authorized administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today