CVE-2026-89989 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
A local attacker can trigger a kernel crash by setting a long extended attribute, causing a null pointer dereference in the IMA subsystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89989?
CVE-2026-89989 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the buffer. validate_hash_algo() passes the result straight to integrity_audit_msg() without checking. ERR_PTR is not NULL, so integrity_audit_message() sees a valid pointer and calls strlen() on it, which faults:
BUG: unable to handle page fault for address: ffffffffffffffdc RIP: 0010:strlen+0x30/0xa0 Call Trace: audit_log_untrustedstring+0x19/0x30 integrity_audit_message+0x366/0x4f0 ima_inode_setxattr+0x512/0x5f0
Check for IS_ERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing.
Which versions are affected by CVE-2026-89989?
How do I fix CVE-2026-89989?
Apply the vendor's patch.
Is CVE-2026-89989 being exploited?
There is no known exploitation of CVE-2026-89989 in the wild and no public exploit code.
Sources
Also known as AZL-101462, BELL-CVE-2026-89989, DEBIAN-CVE-2026-89989, GHSA-f29m-6gq2-85cm, UBUNTU-CVE-2026-89989.