CVE-2026-89726lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 04ae68af4107600120c3c41c94268f43bc350d48; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2e5a70a175f0c74e7238b013a96c4eabc3002934; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3ada20e110bf3245edb0a3bcddadc33d0f142f8d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 60c74f42f5abddb85dd919b4448d5474e65dbe76; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 709eb41adaf78d59d4579a13a898125919b69bcc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7d658da725ea81c91f73087547b97e7ced82d62b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1b0dc3cbb8630f0b5cb34d848628225920a904be; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cec0d03fe785380540dc1b4d07c80f67ae2ffc78 | CNA record |
References
- https://git.kernel.org/stable/c/04ae68af4107600120c3c41c94268f43bc350d48
- https://git.kernel.org/stable/c/2e5a70a175f0c74e7238b013a96c4eabc3002934
- https://git.kernel.org/stable/c/3ada20e110bf3245edb0a3bcddadc33d0f142f8d
- https://git.kernel.org/stable/c/60c74f42f5abddb85dd919b4448d5474e65dbe76
- https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc
- https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b
- https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be
- https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.