CVE-2026-89552
Received Received - Intake

Kernel NULL Pointer Dereference in Linux Kernel params Module

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL. Failing zswap's compressor update before zswap is initialized can later trigger: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswap_setup+0x3b1/0x490 zswap_enabled_param_set+0x5b/0xa0 param_attr_store+0x93/0xe0 module_attr_store+0x1c/0x30 kernfs_fop_write_iter+0x116/0x1f0 Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89552
EUVD
EUVD-2026-76463

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the param_set_charp() function where memory corruption can occur if parameter allocation fails. The function releases the previous parameter value before confirming the new allocation succeeds, which can lead to a NULL pointer dereference later, especially during zswap initialization.

Detection Guidance

This vulnerability is specific to the Linux kernel and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors or crashes related to zswap or parameter handling. Use commands like dmesg | grep -i 'null pointer' or journalctl -k | grep -i 'null pointer' to inspect system logs for signs of exploitation.

Impact Analysis

If exploited, this vulnerability could cause system crashes due to kernel NULL pointer dereferences. It may affect systems using zswap with compressor updates, potentially leading to denial-of-service conditions or instability.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution vendor and apply patches promptly. If immediate patching is not possible, consider disabling zswap temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart