{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89726", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.759Z", "datePublished": "2026-09-11T19:46:37.480Z", "dateUpdated": "2026-09-11T19:46:37.480Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:37.480Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()\n\nPatch series \"lib/ucs2_string.c: fix out-of-bounds read in\nucs2_strnlen()\", v2.\n\nThis series fixes an off-by-one out-of-bounds read in ucs2_strnlen().\n\nThe first patch is the real fix, the second patch comes as a bonus and\nfixes the code indentation.\n\n\nThis patch (of 2):\n\nucs2_strnlen() checks the current character before checking whether the\ncaller-provided maximum length has been reached. If the input is not\nNUL-terminated within that bound, the loop can read one ucs2_char_t past\nthe limit.\n\nTest the length before dereferencing to prevent an off-by-one\nout-of-bounds read."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/ucs2_string.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "709eb41adaf78d59d4579a13a898125919b69bcc", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7d658da725ea81c91f73087547b97e7ced82d62b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1b0dc3cbb8630f0b5cb34d848628225920a904be", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cec0d03fe785380540dc1b4d07c80f67ae2ffc78", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/ucs2_string.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc"}, {"url": "https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b"}, {"url": "https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be"}, {"url": "https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78"}], "title": "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["lib/ucs2_string.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "709eb41adaf78d59d4579a13a898125919b69bcc", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "7d658da725ea81c91f73087547b97e7ced82d62b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "1b0dc3cbb8630f0b5cb34d848628225920a904be", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "cec0d03fe785380540dc1b4d07c80f67ae2ffc78", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["lib/ucs2_string.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()\n\nPatch series \"lib/ucs2_string.c: fix out-of-bounds read in\nucs2_strnlen()\", v2.\n\nThis series fixes an off-by-one out-of-bounds read in ucs2_strnlen().\n\nThe first patch is the real fix, the second patch comes as a bonus and\nfixes the code indentation.\n\n\nThis patch (of 2):\n\nucs2_strnlen() checks the current character before checking whether the\ncaller-provided maximum length has been reached. If the input is not\nNUL-terminated within that bound, the loop can read one ucs2_char_t past\nthe limit.\n\nTest the length before dereferencing to prevent an off-by-one\nout-of-bounds read."}], "id": "CVE-2026-89726", "lastModified": "2026-09-11T20:20:02.907", "metrics": {}, "published": "2026-09-11T20:20:02.907", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Out-of-bounds read in ucs2_strnlen() can lead to information disclosure", "id": "2532261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532261"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not properly terminated within the specified bounds, an attacker could potentially trigger an out-of-bounds read, which may lead to information disclosure or a denial of service."], "name": "CVE-2026-89726", "public_date": "2026-09-11T19:46:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89726\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89726\nhttps://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be\nhttps://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc\nhttps://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b\nhttps://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78"], "threat_severity": "Moderate"}

{"created": "2026-09-12T06:00:11.706300+00:00", "updated": "2026-09-12T06:00:11.706306+00:00", "vendors": []}