CVE-2026-89754: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89754 Overview

CVE-2026-89754 is a Linux kernel memory management vulnerability in the page walking subsystem (mm/pagewalk). A stale walk->action value can escape walk_pmd_range() when ->pmd_entry() sets ACTION_AGAIN and the retried pmd_none() check finds a cleared PMD entry. Following commit 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault"), walk_pud_range() retries the PUD walk on ACTION_AGAIN, producing duplicate walk callbacks. A local fuzzer triggered the resulting out-of-bounds write via the mincore() syscall, corrupting memory in the sigqueue slab cache. The flaw is locally exploitable and requires only low privileges.

Critical Impact
A local unprivileged user can trigger an out-of-bounds slab write in the kernel via mincore(), enabling denial of service and potential local privilege escalation.

Affected Products

Linux kernel versions containing commit 3b89863c3fa4 ("mm/pagewalk: fix race between concurrent split and refault")
Kernel builds using the mm/pagewalk page table walking infrastructure
Systems exposing the mincore() syscall to unprivileged local users

Discovery Timeline

2026-09-11 - CVE-2026-89754 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89754

Vulnerability Analysis

The defect lives in walk_pmd_range() within the Linux kernel's page table walker. When a ->pmd_entry() callback sets walk->action = ACTION_AGAIN, the walker retries the pmd_none() check on the same PMD entry. If the PMD is cleared at the point of retry and walk->ops->install_pte is not defined, control falls through to the next PMD entry without resetting walk->action to ACTION_SUBTREE.

The stale ACTION_AGAIN value then propagates back to walk_pud_range(). Because commit 3b89863c3fa4 added a check in walk_pud_range() that retries the PUD walk when it observes ACTION_AGAIN, the walker invokes callbacks a second time for entries it already processed. Callers that are not idempotent, such as __mincore_unmapped_range(), then write past the end of the caller-supplied buffer, producing a KASAN-reported slab-out-of-bounds write of a byte into an adjacent 80-byte sigqueue allocation.

Root Cause

The root cause is missing state reset logic. When walk_pmd_range() takes the retry-then-skip path due to a cleared PMD without an install_pte handler, it fails to restore walk->action from ACTION_AGAIN to ACTION_SUBTREE before continuing iteration. This is an out-of-bounds write ([CWE-787]) that emerges from an internal control-flow state error.

Attack Vector

Exploitation requires only local, low-privilege access. A local user issues an mincore() syscall (syscall number 0x1b) against a memory range whose PMD entries can be raced or cleared concurrently, causing the pagewalk callback to be invoked twice. The second invocation writes one byte past the destination vector buffer allocated in the kernel sigqueue slab cache. The vulnerability was reproduced by a local fuzzer that observed the KASAN report slab-out-of-bounds in __mincore_unmapped_range+0x14f/0x190. No user interaction or network access is required. See the upstream fixes: Kernel commit 895cd4e, Kernel commit aedf2ef, and Kernel commit c05cdc2.

Detection Methods for CVE-2026-89754

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in __mincore_unmapped_range in kernel logs (dmesg, /var/log/kern.log).
Unexpected kernel oops or panics originating from walk_pgd_range, walk_pud_range, or __walk_page_range stack frames.
Repeated mincore() syscalls from non-privileged processes performing rapid memory mapping and unmapping.

Detection Strategies

Enable KASAN on test and staging kernels to catch out-of-bounds writes from pagewalk callers before production impact.
Monitor auditd or eBPF probes for anomalous mincore() syscall frequency by unprivileged UIDs.
Alert on kernel taint state changes and any BUG or WARN messages tagged with mm/pagewalk or mincore.

Monitoring Recommendations

Ship kernel ring buffer and syslog events to a centralized analytics platform and search for KASAN, BUG:, and walk_pmd_range substrings.
Track process behavior baselines to flag user processes issuing bursts of memory-introspection syscalls (mincore, mprotect, madvise).
Use crash dump collection (kdump) to preserve forensic state when the fault triggers.

How to Mitigate CVE-2026-89754

Immediate Actions Required

Apply the upstream stable kernel updates containing the fix commits 895cd4e, aedf2ef, and c05cdc2 as soon as vendor packages are available.
Prioritize patching multi-tenant hosts, container hosts, and shared build systems where untrusted local code executes.
Reboot systems after patching to load the corrected mm/pagewalk implementation.

Patch Information

The fix restores walk->action to ACTION_SUBTREE on the retry-skip path in walk_pmd_range(), preventing stale ACTION_AGAIN state from causing duplicate PUD-level walks. Upstream commits are available at Kernel commit 895cd4e, Kernel commit aedf2ef, and Kernel commit c05cdc2. Confirm your distribution has backported the patch to the kernel package installed on affected systems.

Workarounds

Restrict local access on affected hosts and remove shell access for untrusted users until patches are deployed.
Use seccomp or Landlock policies to deny or heavily rate-limit the mincore() syscall for untrusted workloads and containers.
Deploy sandboxing (gVisor, Kata Containers) for untrusted workloads to isolate the kernel attack surface.

bash

# Example seccomp fragment denying mincore for untrusted workloads
# Apply via container runtime seccomp profile
{
  "defaultAction": "SCMP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["mincore"],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1
    }
  ]
}