{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89754 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89754 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89754 and fix it if it is affected.\n\nWhat it is: CVE-2026-89754 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89754 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89754/ (Markdown: https://insights.sbomify.com/CVE-2026-89754/index.md)","id":"CVE-2026-89754","markdown":"https://insights.sbomify.com/CVE-2026-89754/index.md","name":"CVE-2026-89754","record":{"aliases":["BELL-CVE-2026-89754","DEBIAN-CVE-2026-89754","GHSA-6j58-c7p9-8cjq","UBUNTU-CVE-2026-89754"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger an out-of-bounds write in the Linux kernel page walker, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/pagewalk: fix stale walk-\u003eaction escaping walk_pmd_range()\n\nIf -\u003epmd_entry() sets walk-\u003eaction = ACTION_AGAIN, the pmd_none() check is\nretried.  The PMD entry may be cleared at the point of retry.\n\nIn this case, if walk-\u003eops-\u003einstall_pte is not specified, the code\ncontinues to the next PMD entry in the range without resetting\nwalk-\u003eaction to ACTION_SUBTREE.\n\nThis leaves walk-\u003eaction erroneously set to ACTION_AGAIN, which is\nincorrect.\n\nThis was incorrect but not problematic up until commit 3b89863c3fa4\n(\"mm/pagewalk: fix race between concurrent split and refault\") which\nupdated walk_pud_range() to check for walk-\u003eaction == ACTION_AGAIN upon\nwalk_pmd_range()'s return, causing the PUD walk to be retried.\n\nIn this case this results in duplicate walk callbacks being invoked,\nwhich is erroneous and will break any caller that is not idempotent\nwith respect to this (and waste time for those which are).  The result\nis an out-of-bounds write, triggered by a local fuzzer:\n\n[    2.272695] ==================================================================\n[    2.273471] BUG: KASAN: slab-out-of-bounds in __mincore_unmapped_range+0x14f/0x190\n[    2.274302] Write of size 1 at addr ffff888008d9b000 by task poc/106\n[    2.274966]\n[    2.275154] CPU: 0 UID: 1000 PID: 106 Comm: poc Not tainted 7.2.0-rc6-00429-ga7c7074b58d2 #55 PREEMPT(lazy)\n[    2.275159] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    2.275164] Call Trace:\n[    2.275170]  \u003cTASK\u003e\n[    2.275172]  dump_stack_lvl+0x53/0x70\n[    2.275200]  print_report+0xd0/0x630\n[    2.275210]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[    2.275219]  ? irqentry_exit+0xd2/0x670\n[    2.275224]  ? irqentry_exit+0xd2/0x670\n[    2.275226]  ? __virt_addr_valid+0xef/0x1a0\n[    2.275239]  ? __mincore_unmapped_range+0x14f/0x190\n[    2.275242]  kasan_report+0xce/0x100\n[    2.275245]  ? __mincore_unmapped_range+0x14f/0x190\n[    2.275248]  __mincore_unmapped_range+0x14f/0x190\n[    2.275252]  mincore_unmapped_range+0x45/0x70\n[    2.275254]  walk_pgd_range+0xafc/0xfc0\n[    2.275261]  ? __pfx_walk_pgd_range+0x10/0x10\n[    2.275264]  ? __update_load_avg_se+0x3d1/0x670\n[    2.275275]  __walk_page_range+0xc0/0x310\n[    2.275278]  ? __pfx_find_vma+0x10/0x10\n[    2.275281]  ? finish_task_switch.isra.0+0x16d/0x4f0\n[    2.275290]  walk_page_range_mm_unsafe+0x26f/0x3a0\n[    2.275293]  ? __pfx_mtree_load+0x10/0x10\n[    2.275298]  ? __pfx_walk_page_range_mm_unsafe+0x10/0x10\n[    2.275302]  ? __free_frozen_pages+0x54d/0x7e0\n[    2.275308]  __do_sys_mincore+0x132/0x380\n[    2.275311]  do_syscall_64+0xf9/0x540\n[    2.275316]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[    2.275322] RIP: 0033:0x422ccd\n[    2.275326] Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\n[    2.275329] RSP: 002b:00007fffffffec18 EFLAGS: 00000287 ORIG_RAX: 000000000000001b\n[    2.275337] RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000422ccd\n[    2.275339] RDX: 00000000004d0940 RSI: 0000000001000000 RDI: 00007ffff4000000\n[    2.275340] RBP: 00000000004d0940 R08: 0000000000000100 R09: 0000000000000100\n[    2.275342] R10: 0000000000000100 R11: 0000000000000287 R12: 20c49ba5e353f7cf\n[    2.275343] R13: 00000000004990d3 R14: 0000000000000000 R15: 0000000000000001\n[    2.275346]  \u003c/TASK\u003e\n[    2.275347]\n[    2.296904] The buggy address belongs to the object at ffff888008d9b000\n[    2.296904]  which belongs to the cache sigqueue of size 80\n[    2.298151] The buggy address is located 0 bytes inside of\n[    2.298151]  allocated 80-byte region [ffff888008d9b000, ffff888008d9b050)\n[    2.299408]\n[    2.299601] The buggy address belongs to the physical page:\n[    2.300191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8d9b\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-18","github_poc":1,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-18T23:33:09Z","kind":"github_poc","ref":"https://github.com/ylh440104/InfinityCore-Android-CVE-2026-89754","stars":2,"title":"Android/ARM64 port"}],"tier":"poc_unverified"},"has_fix":true,"headline":"mm/pagewalk: fix stale walk-\u003eaction escaping walk_pmd_range()","id":"CVE-2026-89754","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"mm/migrate_device: clear stale mapping after freeing swapcache","id":"CVE-2026-89755"},"packages":[],"prev":{"headline":"mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()","id":"CVE-2026-89753"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can trigger an out-of-bounds write in the Linux kernel page walker, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-89754/"}