CVE-2026-89726

Received Received - Intake

Out-of-Bounds Read in Linux Kernel ucs2_strnlen

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89726

EUVD

EUVD-2026-76638

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability in the Linux kernel's ucs2_strnlen() function. The function checks characters before verifying if the maximum length has been reached, which can cause it to read one ucs2_char_t past the input buffer if the string is not NUL-terminated within the specified limit.

Detection Guidance

This vulnerability is specific to the Linux kernel's ucs2_strnlen() function and requires kernel-level detection. Check if your kernel version includes the vulnerable code by examining the lib/ucs2_string.c file in the kernel source. Use commands like 'uname -a' to check kernel version and 'grep -r ucs2_strnlen() /usr/src/linux*' to locate the function in kernel sources.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory, potentially leading to information disclosure or further exploits. Systems using vulnerable Linux kernel versions may be at risk if this function is called with untrusted input.

Compliance Impact

This vulnerability is an out-of-bounds read in the Linux kernel's ucs2_strnlen() function. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than low-level memory safety issues.

Mitigation Strategies

Apply the kernel patch provided in the CVE description to fix the off-by-one out-of-bounds read in ucs2_strnlen(). Update your Linux kernel to a version that includes this patch. Monitor vendor advisories for kernel updates and test patches in a non-production environment before full deployment.

Hi! I’m here to help you understand CVE-2026-89726. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70