GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89555 (GCVE-0-2026-89555)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
mpls: reload header after pskb_may_pull()
Summary
In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again when it performs a second pull for the larger header. The issue was found through static analysis. A reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header pointer.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9f427a0e474a67b454420c131709600d44850486 , < aa4fe0b450a461aa1162fe8375f5d28f4c957df8 (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < b1c0783b2facc398437ad8f8b86c636d7a78f8db (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < bfaaff99238326166694354a63a76c02563f98b1 (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < d9640239827d6d0cb84263b590f7a4f1596c17eb (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < fed638a248116b8a249bd4202d28e5934bdc65ad (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < d82b90a38c2ca8a0694428eab0e9551c23f2447d (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < 49d38c1b4390412f8950d33dfaee0ccbd17beb81 (git)
Affected: 9f427a0e474a67b454420c131709600d44850486 , < 29e63b8d9fc150cc191b1c6eb7e16e1247e1b650 (git)
Affected: ad864d9fce0ec56cc8f6afe5c6a0e6d7f484b9eb (git)
Affected: 4.9.8 , < 4.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mpls/af_mpls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa4fe0b450a461aa1162fe8375f5d28f4c957df8",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "b1c0783b2facc398437ad8f8b86c636d7a78f8db",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "bfaaff99238326166694354a63a76c02563f98b1",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "d9640239827d6d0cb84263b590f7a4f1596c17eb",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "fed638a248116b8a249bd4202d28e5934bdc65ad",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "d82b90a38c2ca8a0694428eab0e9551c23f2447d",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "49d38c1b4390412f8950d33dfaee0ccbd17beb81",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "lessThan": "29e63b8d9fc150cc191b1c6eb7e16e1247e1b650",
              "status": "affected",
              "version": "9f427a0e474a67b454420c131709600d44850486",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ad864d9fce0ec56cc8f6afe5c6a0e6d7f484b9eb",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mpls/af_mpls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: reload header after pskb_may_pull()\n\nmpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop\nwhen an MPLS route has multiple nexthops.  While walking the MPLS label\nstack, the hash routine caches hdr for the current label.  After finding\nthe bottom-of-stack label, it calls pskb_may_pull() before reading the\ninner IP header.\n\nIf an skb is constructed with the inner IP header in nonlinear data and\ninsufficient tailroom in the linear head, pskb_may_pull() calls\npskb_expand_head() to replace the skb head and free the old one.  This\nleaves hdr pointing to freed memory.  The IPv6 path can invalidate hdr\nagain when it performs a second pull for the larger header.\n\nThe issue was found through static analysis.  A reproducer sending a legal\nGeneve packet through a bareudp/MPLS multipath setup triggered the same\nKASAN report in 2 of 2 unpatched runs:\n\n  BUG: KASAN: slab-use-after-free in mpls_select_multipath\n  Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23\n\n  Call Trace:\n   mpls_select_multipath\n   mpls_forward\n   __netif_receive_skb_list_core\n   netif_receive_skb_list_internal\n   napi_complete_done\n   gro_cell_poll\n   __napi_poll\n   net_rx_action\n\n  Freed by task 23:\n   kfree\n   pskb_expand_head\n   __pskb_pull_tail\n   mpls_select_multipath\n\nReload hdr from the current skb head after each successful pull before\nderiving the inner IPv4 or IPv6 header pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - mpls_forward() is the ETH_P_MPLS_UC packet_type receive handler; remote MPLS-in-IP (IPPROTO_MPLS), MPLS-over-UDP/bareudp, Geneve, and IPIP/SIT/ip6 tunnels deliver inner MPLS into this path without local access, matching the Geneve/bareudp KASAN reproducer.\nAC:L - An attacker sending MPLS or tunneled overlay frames fully controls the label stack, BOS bit, and skb layout; GRO/tunnel decap yields nonlinear skbs so pskb_may_pull() reallocates skb-\u003ehead, and the unpatched Geneve reproducer hit the UAF in 2 of 2 runs with no victim-timed race.\nPR:N - Exploitation needs only unauthenticated packets that hit an already configured MPLS-enabled interface and multipath label route; mpls_forward() performs no credential check, and enabling MPLS input or tunnels is victim deployment rather than an attacker privilege.\nUI:N - The use-after-free runs in softirq receive processing (gro_cell_poll / netif_receive_skb_list) as soon as the crafted frame is accepted; no local user or administrator action is required beyond normal forwarding.\nS:U - The stale MPLS header pointer is a heap use-after-free inside the same host kernel MPLS forwarding path; impact stays within that kernel security authority and does not cross a VM, IOMMU, or other boundary.\nC:H - After pskb_expand_head() frees the old skb head, mpls_multipath_hash() reads the inner IPv4/IPv6 header through the stale hdr pointer, a slab use-after-free that can disclose freed kmalloc contents and is scored as high-impact kernel information disclosure.\nI:H - The immediate stale access is a header read used for ECMP hashing, but it remains a kernel slab use-after-free of skb-\u003ehead; attacker-controlled reclaim of the freed kmalloc object is a well-established path to heap corruption and control-flow hijacking.\nA:H - KASAN confirmed a slab-use-after-free in mpls_select_multipath() on the forwarding path; dereferencing the freed skb head can oops or panic the kernel, and UAFs remain a high-impact denial of service even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:57.921Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa4fe0b450a461aa1162fe8375f5d28f4c957df8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1c0783b2facc398437ad8f8b86c636d7a78f8db"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfaaff99238326166694354a63a76c02563f98b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9640239827d6d0cb84263b590f7a4f1596c17eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/fed638a248116b8a249bd4202d28e5934bdc65ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/d82b90a38c2ca8a0694428eab0e9551c23f2447d"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d38c1b4390412f8950d33dfaee0ccbd17beb81"
        },
        {
          "url": "https://git.kernel.org/stable/c/29e63b8d9fc150cc191b1c6eb7e16e1247e1b650"
        }
      ],
      "title": "mpls: reload header after pskb_may_pull()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89555",
    "datePublished": "2026-09-11T19:44:28.331Z",
    "dateReserved": "2026-09-11T19:38:34.724Z",
    "dateUpdated": "2026-09-14T12:00:57.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89555",
      "date": "2026-09-15",
      "epss": "0.00684",
      "percentile": "0.50693"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89555\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:39.147\",\"lastModified\":\"2026-09-14T13:19:10.610\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmpls: reload header after pskb_may_pull()\\n\\nmpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop\\nwhen an MPLS route has multiple nexthops.  While walking the MPLS label\\nstack, the hash routine caches hdr for the current label.  After finding\\nthe bottom-of-stack label, it calls pskb_may_pull() before reading the\\ninner IP header.\\n\\nIf an skb is constructed with the inner IP header in nonlinear data and\\ninsufficient tailroom in the linear head, pskb_may_pull() calls\\npskb_expand_head() to replace the skb head and free the old one.  This\\nleaves hdr pointing to freed memory.  The IPv6 path can invalidate hdr\\nagain when it performs a second pull for the larger header.\\n\\nThe issue was found through static analysis.  A reproducer sending a legal\\nGeneve packet through a bareudp/MPLS multipath setup triggered the same\\nKASAN report in 2 of 2 unpatched runs:\\n\\n  BUG: KASAN: slab-use-after-free in mpls_select_multipath\\n  Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23\\n\\n  Call Trace:\\n   mpls_select_multipath\\n   mpls_forward\\n   __netif_receive_skb_list_core\\n   netif_receive_skb_list_internal\\n   napi_complete_done\\n   gro_cell_poll\\n   __napi_poll\\n   net_rx_action\\n\\n  Freed by task 23:\\n   kfree\\n   pskb_expand_head\\n   __pskb_pull_tail\\n   mpls_select_multipath\\n\\nReload hdr from the current skb head after each successful pull before\\nderiving the inner IPv4 or IPv6 header pointer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mpls/af_mpls.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"aa4fe0b450a461aa1162fe8375f5d28f4c957df8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"b1c0783b2facc398437ad8f8b86c636d7a78f8db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"bfaaff99238326166694354a63a76c02563f98b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"d9640239827d6d0cb84263b590f7a4f1596c17eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"fed638a248116b8a249bd4202d28e5934bdc65ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"d82b90a38c2ca8a0694428eab0e9551c23f2447d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"49d38c1b4390412f8950d33dfaee0ccbd17beb81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f427a0e474a67b454420c131709600d44850486\",\"lessThan\":\"29e63b8d9fc150cc191b1c6eb7e16e1247e1b650\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ad864d9fce0ec56cc8f6afe5c6a0e6d7f484b9eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.8\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mpls/af_mpls.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29e63b8d9fc150cc191b1c6eb7e16e1247e1b650\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/49d38c1b4390412f8950d33dfaee0ccbd17beb81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa4fe0b450a461aa1162fe8375f5d28f4c957df8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b1c0783b2facc398437ad8f8b86c636d7a78f8db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bfaaff99238326166694354a63a76c02563f98b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d82b90a38c2ca8a0694428eab0e9551c23f2447d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d9640239827d6d0cb84263b590f7a4f1596c17eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fed638a248116b8a249bd4202d28e5934bdc65ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T10:56:54+00:00",
      "cve": "CVE-2026-89555",
      "id": "CVE-2026-89555",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mpls: reload header after pskb_may_pull()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89555.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.