CVE-2026-89992cpuidle: dt_idle_genpd: kfree() the original name allocation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree() the original name allocation dt_idle_pd_alloc() kasprintf()s the full node path, then points pd->name at kbasename() of that string. dt_idle_pd_free() kfree()s pd->name, which is no longer the start of the allocation. Copy the basename instead.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9d976d6721dfb525b81ce981e1363c70c0975aab before 1312ae33b91430ec99e69cd3d47f0e50a4ebf54b; from 9d976d6721dfb525b81ce981e1363c70c0975aab before a38caa9ed0d5c61c17d88393b14b292199289c1f; 9d976d6721dfb525b81ce981e1363c70c0975aab builds before 09d002c8fb0261d35ce9d8a705de5db034ee90b8; from 9d976d6721dfb525b81ce981e1363c70c0975aab before b519dfce1998c323e54a56f911cf708d9ba0e076; from 9d976d6721dfb525b81ce981e1363c70c0975aab before 3394c7ba23336bdb7ece29127130fd01731d42d8; 9d976d6721dfb525b81ce981e1363c70c0975aab builds before 2b0ac85512b7f67479127b2713254490662eb13d | CNA record |
References
- https://git.kernel.org/stable/c/1312ae33b91430ec99e69cd3d47f0e50a4ebf54b
- https://git.kernel.org/stable/c/a38caa9ed0d5c61c17d88393b14b292199289c1f
- https://git.kernel.org/stable/c/09d002c8fb0261d35ce9d8a705de5db034ee90b8
- https://git.kernel.org/stable/c/b519dfce1998c323e54a56f911cf708d9ba0e076
- https://git.kernel.org/stable/c/3394c7ba23336bdb7ece29127130fd01731d42d8
- https://git.kernel.org/stable/c/2b0ac85512b7f67479127b2713254490662eb13d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.