CVE-2026-89743

Received Received - Intake

Heap Buffer Overflow in Linux Kernel NSM Driver

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fill_req_raw(); the response path lacks the symmetric check. Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-89743

EUVD

EUVD-2026-76655

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the Linux kernel's NSM (Notification Subsystem Manager) driver. A malicious or buggy backend device can report a response length larger than the allocated buffer. The kernel then copies this excessive data to user space, exposing adjacent kernel heap memory.

Detection Guidance

This vulnerability involves a Linux kernel issue with the NSM device response length handling. Detection requires checking kernel logs for out-of-bounds read errors or heap disclosures related to the nsm module. Use commands like dmesg | grep nsm or journalctl -k | grep nsm to inspect kernel logs for suspicious activity.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory, potentially leaking passwords, encryption keys, or other confidential data. This could lead to privilege escalation or further system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized disclosure of kernel heap memory to user space. An out-of-bounds read may expose sensitive data, which could violate data protection requirements under these regulations if exploited.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Update your system using your package manager (e.g., apt upgrade linux-image or yum update kernel). Reboot the system to load the patched kernel. If immediate patching is not possible, consider disabling the NSM device functionality if not required.

Hi! I’m here to help you understand CVE-2026-89743. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70