CVE-2026-89437: Linux Kernel Memory Leak Vulnerability

CVE-2026-89437 Overview

CVE-2026-89437 is a memory leak vulnerability in the Linux kernel's platform/x86: int1092 driver. The flaw resides in the sar_probe() function, which handles Specific Absorption Rate (SAR) sensor initialization on x86 platforms. Memory allocated for device_mode_info inside parse_package() — called through sar_get_data() — is not released along several error paths in sar_probe(). Repeated failed probe attempts can gradually exhaust kernel memory. The upstream fix converts the affected allocations to device-managed (devm_*) allocations so the kernel automatically frees resources when the device is detached or probing fails.

Critical Impact
Local triggering of probe error paths can leak kernel memory, contributing to resource exhaustion on affected Linux systems.

Affected Products

Linux kernel platform/x86 subsystem — intel/int1092 (SAR) driver
Distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems using Intel SAR sensor hardware on x86 platforms

Discovery Timeline

2026-09-11 - CVE-2026-89437 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89437

Vulnerability Analysis

The int1092 driver initializes Intel SAR sensor data during platform probing. When sar_probe() calls sar_get_data(), the helper invokes parse_package() to allocate memory for a device_mode_info structure that describes SAR operating modes. If sar_probe() subsequently fails after this allocation succeeds, several error paths return without freeing the allocated buffer. Each failed probe leaks the associated kernel memory. Memory leaks in probe paths are classified as [CWE-401] Missing Release of Memory after Effective Lifetime.

The leak is bounded per probe attempt but accumulates across repeated device add/remove or module reload cycles. On long-running systems or under fault-injection conditions, this can contribute to slow degradation of available kernel memory.

Root Cause

The root cause is an inconsistent memory ownership model in sar_probe(). parse_package() uses standard heap allocation for device_mode_info, but the caller does not free the buffer on every failure path. The upstream fix converts the allocation to a device-managed (devm_*) API so the kernel automatically frees the memory when the device is unbound or probing fails.

Attack Vector

The vulnerability is triggered locally through the driver probe lifecycle. An attacker or fault condition that repeatedly forces sar_probe() down an error path — for example, by unbinding and re-binding the device, reloading the module, or supplying malformed ACPI package data — can cause incremental leakage of kernel memory. Remote exploitation is not applicable because probing requires local platform interaction with the SAR device.

No public proof-of-concept exploit is available. See the upstream commits 08dab70, 30c906c, and 582b82e for the technical fix.

Detection Methods for CVE-2026-89437

Indicators of Compromise

Gradual reduction in MemAvailable reported by /proc/meminfo on systems using the int1092 driver
Repeated sar_probe failure messages in dmesg or the systemd journal
Growth in kmalloc slab counters correlated with driver bind/unbind cycles

Detection Strategies

Enable kmemleak (CONFIG_DEBUG_KMEMLEAK) on test systems to identify unreleased device_mode_info allocations originating from parse_package()
Audit installed kernel packages against distribution advisories that reference the fix commits 08dab70, 30c906c, or 582b82e
Monitor kernel logs for repeated probe failures in the platform/x86 subsystem

Monitoring Recommendations

Track long-term trends in kernel slab usage via /proc/slabinfo and Prometheus node exporter metrics
Alert on unexpected module reload activity for int1092 and related platform/x86 drivers
Correlate probe error log entries with memory pressure events across the fleet

How to Mitigate CVE-2026-89437

Immediate Actions Required

Inventory Linux hosts running kernels that include the vulnerable int1092 driver code
Apply vendor kernel updates that incorporate the upstream commits 08dab70, 30c906c, and 582b82e
Reboot affected systems after patching to load the corrected driver

Patch Information

The fix converts affected allocations in sar_probe() to device-managed (devm_*) allocations so that resources are released automatically on error or device detach. The patch is available in the stable trees via commits 08dab70, 30c906c, and 582b82e. Consume the fix through your distribution's kernel update channel.

Workarounds

Blacklist the int1092 module on systems that do not require SAR sensor functionality
Avoid repeated bind/unbind or module reload cycles for the int1092 driver until patched
Monitor kernel memory consumption and schedule reboots to reclaim leaked memory if patching is delayed

bash

# Blacklist the int1092 module on systems that do not need SAR support
echo "blacklist int1092" | sudo tee /etc/modprobe.d/blacklist-int1092.conf
sudo update-initramfs -u
sudo reboot