CVE-2026-89552 Overview
CVE-2026-89552 is a Linux kernel vulnerability in the module parameter subsystem. The flaw resides in param_set_charp(), which handles updates to charp (character pointer) module parameters. The setter releases the previous parameter value before the replacement allocation succeeds. When kmalloc_parameter() fails, the setter returns -ENOMEM and leaves the parameter pointing to NULL.
A subsequent read of the parameter can trigger a kernel null pointer dereference. The public trace shows the issue reached through zswap, where failing a compressor update before zswap initialization later crashed zswap_setup() inside strcmp().
Critical Impact
A failed allocation during a charp module parameter update can leave the parameter as NULL, producing a kernel null pointer dereference and a denial-of-service condition on subsequent reads.
Affected Products
- Linux kernel builds using param_set_charp() for module parameter handling
- Kernels exposing zswap compressor and related charp parameters via sysfs
- Stable branches referenced by upstream fix commits 0d8e2404, 3dfaae04, 614f8732, and 704ecd01
Discovery Timeline
- 2026-09-11 - CVE-2026-89552 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89552
Vulnerability Analysis
The Linux kernel exposes module parameters of type charp as pointers to strings that can be replaced at runtime. The helper param_set_charp() allocates memory for the new value using kmalloc_parameter() once the slab allocator is available, then frees the previous value when the parameter is updated.
The update path releases the previous string before confirming that the replacement allocation succeeded. When kmalloc_parameter() returns NULL under memory pressure, the setter returns -ENOMEM while the parameter pointer is already NULL. Any code that later reads the parameter without a null check dereferences a null pointer in kernel context.
The committed public reproducer targets zswap. Writing a new compressor value before zswap initialization can fail the allocation and null the compressor parameter. A later attempt to enable zswap invokes zswap_setup(), which passes the parameter into strcmp() and crashes with BUG: kernel NULL pointer dereference, address: 0000000000000000 at RIP: strcmp+0x10/0x30.
The defect is a null pointer dereference caused by an unsafe update ordering in the parameter setter, categorized under improper resource management on allocation failure.
Root Cause
The root cause is a free-before-allocate pattern in param_set_charp(). The function frees the current parameter buffer prior to verifying that the replacement allocation succeeded. On allocation failure the parameter is left as NULL while the caller receives an error return, breaking the invariant that consumers expect a valid string pointer.
Attack Vector
Exploitation requires the ability to write to a charp module parameter, typically through sysfs entries such as /sys/module/<name>/parameters/<param>. On most systems this requires privileged access, which limits impact to local denial of service. The primary consequence is a kernel oops or panic when a downstream code path reads the corrupted parameter, as demonstrated by the zswap strcmp() crash.
No verified proof-of-concept code is published beyond the crash trace included in the upstream commit message. See the upstream fix commits for the full patch context: Kernel Git Commit 0d8e240, Kernel Git Commit 3dfaae0, Kernel Git Commit 614f873, and Kernel Git Commit 704ecd0.
Detection Methods for CVE-2026-89552
Indicators of Compromise
- Kernel oops entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: strcmp+0x10/0x30 in the call chain.
- Call traces referencing zswap_setup, zswap_enabled_param_set, param_attr_store, or module_attr_store immediately preceding the crash.
- Prior -ENOMEM returns from writes to /sys/module/*/parameters/* entries backed by charp parameters.
Detection Strategies
- Monitor dmesg and journalctl -k for null pointer dereferences originating in module parameter store handlers or in zswap initialization paths.
- Audit which charp module parameters are writable at runtime and correlate parameter writes with subsequent kernel faults.
- Compare running kernel build identifiers against the fixed commits listed in the upstream references to identify unpatched hosts at scale.
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on NULL pointer dereference events tied to param_attr_store or zswap_* symbols.
- Track sysfs writes to module parameters through audit rules on /sys/module/ to establish a baseline for legitimate configuration changes.
- Alert on unplanned host reboots or kernel panics on systems that expose zswap or other charp-driven tunables.
How to Mitigate CVE-2026-89552
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 0d8e2404, 3dfaae04, 614f8732, and 704ecd01 on all affected hosts.
- Restrict write access to /sys/module/*/parameters/* to root and remove unnecessary privileged tooling that toggles module parameters at runtime.
- Avoid changing zswap compressor values before zswap has been initialized on systems running unpatched kernels.
Patch Information
The fix reorders param_set_charp() so that the replacement string is allocated and populated before the previous value is released. If the allocation fails, the existing parameter value is preserved and -ENOMEM is returned without leaving the parameter as NULL. Distributions should ship kernels containing the referenced stable commits; consult vendor advisories for the exact package versions.
Workarounds
- Reduce memory pressure on hosts that expose writable charp parameters to lower the probability of allocation failure during parameter updates.
- Disable or avoid runtime toggling of features such as zswap on unpatched kernels until the update is deployed.
- Constrain non-root access to sysfs module parameter interfaces using standard filesystem permissions and mandatory access control policies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
