CVE-2026-89992: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89992 Overview

CVE-2026-89992 is a memory management vulnerability in the Linux kernel's cpuidle subsystem, specifically in the dt_idle_genpd driver. The flaw stems from an incorrect kfree() call on a pointer that no longer references the start of the original allocation. The function dt_idle_pd_alloc() allocates a full node path via kasprintf(), then sets pd->name to the result of kbasename(). When dt_idle_pd_free() frees pd->name, it passes an offset pointer to kfree(), corrupting the kernel heap.

Critical Impact
Local heap corruption in the Linux kernel that can lead to loss of confidentiality, integrity, and availability on affected systems.

Affected Products

Linux kernel builds containing the drivers/cpuidle/dt_idle_genpd.c code path
Linux distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Embedded and Arm platforms using device-tree generic power domain (genpd) idle states

Discovery Timeline

2026-09-16 - CVE-2026-89992 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89992

Vulnerability Analysis

The vulnerability resides in the device-tree helper code that registers CPU idle generic power domains. dt_idle_pd_alloc() calls kasprintf() to build a heap-allocated string containing the full device-tree node path. It then stores the result of kbasename() — a pointer into the middle of that same string — into pd->name. During teardown, dt_idle_pd_free() calls kfree(pd->name), passing an interior pointer rather than the original allocation base. The kernel slab allocator requires the exact pointer returned from kmalloc()/kasprintf(); freeing an offset pointer corrupts allocator metadata.

The fix, applied across multiple stable branches, copies the basename into a fresh allocation so that pd->name and the freed pointer both reference the start of a valid allocation.

Root Cause

The root cause is invalid heap free arising from pointer arithmetic on an allocated string. kbasename() returns a pointer into the input string rather than a new allocation. Storing this offset pointer and later freeing it violates the allocator contract, producing slab corruption. This class of defect maps to invalid free and memory management errors in kernel object lifetime handling.

Attack Vector

The attack vector is local. An attacker requires the ability to trigger the allocation and release path for a device-tree idle power domain. On affected platforms, repeated bind/unbind or probe/remove cycles of a driver that registers a genpd idle domain can reach the vulnerable free. Successful exploitation corrupts slab metadata and may enable privilege escalation, denial of service, or kernel memory disclosure depending on adjacent heap contents.

No verified proof-of-concept code is published for this issue. Refer to the upstream commits listed in the references for the exact source-level change.

Detection Methods for CVE-2026-89992

Indicators of Compromise

Kernel log entries reporting slab corruption, BUG: KASAN: invalid-free, or kernel BUG at mm/slub.c associated with dt_idle_pd_free in the call trace.
Unexpected kernel oops or panic during device-tree driver unbind operations on Arm or embedded platforms using genpd idle states.
Repeated driver bind/unbind sequences originating from non-root workflows that touch cpuidle power-domain devices.

Detection Strategies

Enable CONFIG_KASAN and CONFIG_SLUB_DEBUG in test kernels to catch invalid frees during regression testing.
Collect kernel crash telemetry and correlate stack traces referencing dt_idle_pd_free, kbasename, or genpd_remove with the affected kernel version.
Track kernel package versions across the fleet and flag hosts running kernels predating the fix commits 09d002c, 1312ae3, 2b0ac85, 3394c7b, a38caa9, and b519dfc.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on slab-corruption signatures.
Monitor unprivileged process behavior that triggers device driver bind/unbind through sysfs interfaces such as /sys/bus/platform/drivers/*/bind.
Track kernel version inventory continuously to identify unpatched hosts as vendor updates are released.

How to Mitigate CVE-2026-89992

Immediate Actions Required

Identify hosts running Linux kernels that include drivers/cpuidle/dt_idle_genpd.c without the upstream fix.
Apply the vendor-supplied kernel update that incorporates one of the referenced stable commits.
Restrict access to sysfs driver bind/unbind interfaces to root only, and audit any tooling that programmatically probes or removes device-tree drivers.

Patch Information

The fix has been merged into multiple Linux stable branches. Relevant commits include 09d002c8fb02, 1312ae33b914, 2b0ac85512b7, 3394c7ba2333, a38caa9ed0d5, and b519dfce1998, all available in the kernel.org stable tree. The patch replaces the interior pointer assignment with a duplicated basename allocation, so that the pointer freed in dt_idle_pd_free() matches the pointer returned by the allocator.

Workarounds

Where patching is not immediately possible, avoid runtime unbind of drivers that register device-tree genpd idle domains.
Restrict local shell and container access on affected embedded and Arm platforms to reduce exposure to the local attack surface.
Enforce least privilege on management tooling to prevent unprivileged users from reaching sysfs bind/unbind paths.

bash

# Verify running kernel version and check for the fix
uname -r

# Restrict access to sysfs driver bind/unbind interfaces
find /sys/bus/platform/drivers -name bind -o -name unbind \
    -exec chmod 600 {} \;

# Rebuild kernel from stable branch containing the fix
git fetch --tags https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
git cherry-pick 09d002c8fb0261d35ce9d8a705de5db034ee90b8