GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89778 (GCVE-0-2026-89778)

Vulnerability from cvelistv5 – Published: 2026-09-16 08:48 – Updated: 2026-09-16 14:38
VLAI
Title
isofs: fix out-of-bounds page array access on empty zisofs block
Summary
In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && *pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image. Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected. BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < 8b994ac5778a725982fd6a8a3afcaa068d4a93e3 (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < 85904076cece72ee3194646ad7ac8e6659d999aa (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < f03425dcbe04aec3c27b9917e97d7d23a2908dda (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < cd616aa0449a772a6956abf03358f0ff31720580 (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < 9c6eace8d07e90f038c89eb3b756d65a7e259d48 (git)
Affected: 59bc055211b8d266ab6089158058bf8268e02006 , < 68d4d3e78150c7ed7d1195af63ad1e6ace30c661 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.33
Unaffected: 0 , < 2.6.33 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/isofs/compress.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b994ac5778a725982fd6a8a3afcaa068d4a93e3",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "85904076cece72ee3194646ad7ac8e6659d999aa",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "f03425dcbe04aec3c27b9917e97d7d23a2908dda",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "cd616aa0449a772a6956abf03358f0ff31720580",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "9c6eace8d07e90f038c89eb3b756d65a7e259d48",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            },
            {
              "lessThan": "68d4d3e78150c7ed7d1195af63ad1e6ace30c661",
              "status": "affected",
              "version": "59bc055211b8d266ab6089158058bf8268e02006",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/isofs/compress.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()\u0027s empty-block fast path returns\npcount \u003c\u003c PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\"if (poffset \u0026\u0026 *pages)\" reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift \u003e 17, so a crafted \"ZF\" Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - isofs assigns s_export_op to isofs_export_ops; nfsd_read then nfsd_iter_read (vfs_iocb_iter_read) and ksmbd_vfs_read (kernel_read) perform VFS reads that reach generic_file_read_iter, filemap_read, and zisofs_read_folio, so a remote NFS or SMB client can trigger the bug on a host exporting a crafted ISO9660 image.\nAC:L - The attacker fully controls the Rock Ridge ZF parms (rock.c only rejects block_shift \u003e 17) and the zisofs block pointer table; a block_shift below PAGE_SHIFT plus a nonempty sub-page block followed by an empty block (block_start==block_end) deterministically over-advances pages[] with no race.\nPR:N - A remote NFS or SMB client needs only read access to an exported iso9660 tree; AUTH_SYS media-server exports commonly require no host credentials, and compressed regular files default to S_IRUGO. No CAP_SYS_ADMIN on the victim host is required on the read path.\nUI:N - Once an iso9660 volume containing the crafted zisofs file is exported, the NFS or SMB server processes the client\u0027s READ automatically; no separate victim must open a file or click a dialog at attack time beyond that pre-existing export.\nS:U - The slab out-of-bounds pointer load and any memzero_page or SetPageUptodate side effects remain inside the host kernel; this is not a VM escape, IOMMU/DMA bypass, or other cross-authority boundary.\nC:H - zisofs_fill_pages loads an 8-byte pointer from one slot past a kmalloc-8 pages[] allocation and may treat adjacent heap data as a struct page. With heap grooming this memory corruption can be turned into a kernel information-disclosure primitive, so confidentiality impact is High.\nI:H - When the out-of-bounds pointer is non-NULL, memzero_page() writes zeros through kmap_local_page() of the forged page and SetPageUptodate() corrupts page flags, yielding a kernel write primitive against attacker-groomed heap or page objects that can be chained to control-flow hijack.\nA:H - KASAN reports a slab-out-of-bounds read in zisofs_read_folio; feeding a non-page pointer to kmap_local_page or memzero_page oopses or panics the kernel, and the attacker can repeat the NFS, SMB, or local read at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:38:29.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48"
        },
        {
          "url": "https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661"
        }
      ],
      "title": "isofs: fix out-of-bounds page array access on empty zisofs block",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89778",
    "datePublished": "2026-09-16T08:48:18.407Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-09-16T14:38:29.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89778",
      "date": "2026-09-20",
      "epss": "0.00688",
      "percentile": "0.51257"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:13:54.000Z",
      "cve": "CVE-2026-89778",
      "id": "msrc_CVE-2026-89778",
      "initial_release_date": "2026-09-17T01:13:54.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "isofs: fix out-of-bounds page array access on empty zisofs block",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89778.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/isofs/compress.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8b994ac5778a725982fd6a8a3afcaa068d4a93e3",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85904076cece72ee3194646ad7ac8e6659d999aa",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f03425dcbe04aec3c27b9917e97d7d23a2908dda",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd616aa0449a772a6956abf03358f0ff31720580",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c6eace8d07e90f038c89eb3b756d65a7e259d48",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68d4d3e78150c7ed7d1195af63ad1e6ace30c661",
                    "status": "affected",
                    "version": "59bc055211b8d266ab6089158058bf8268e02006",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/isofs/compress.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.33"
                  },
                  {
                    "lessThan": "2.6.33",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: fix out-of-bounds page array access on empty zisofs block\n\nzisofs_uncompress_block()\u0027s empty-block fast path returns\npcount \u003c\u003c PAGE_SHIFT, ignoring the incoming poffset, unlike the\ndecompression path which returns bytes produced relative to poffset.\nzisofs_fill_pages() uses that return to advance its page cursor, so when\nthe zisofs block size is below PAGE_SIZE and a sub-page block leaves\npoffset partway into a page, a following empty block over-counts and\nadvances pages[] one element past its end, after which\n\"if (poffset \u0026\u0026 *pages)\" reads pages[1] out of bounds.  rock.c only\nrejects a block-size shift \u003e 17, so a crafted \"ZF\" Rock Ridge record can\nset it below PAGE_SHIFT; the bug is reached by an ordinary read() of a\ncompressed file on such a mounted ISO9660 image.\n\nReturn the byte count relative to poffset and zero only\n[poffset, PAGE_SIZE) of the first page, matching the decompression path.\nThe page-aligned case (poffset == 0) is unaffected.\n\n  BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)\n  Read of size 8 at addr ffff88800f5eac48 by task exploit/142\n   zisofs_read_folio (fs/isofs/compress.c:290)\n   read_pages (mm/readahead.c:184)\n   ...\n   filemap_read (mm/filemap.c:2814)\n   vfs_read (fs/read_write.c:574)\n   __x64_sys_pread64 (fs/read_write.c:769)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  The buggy address is located 0 bytes to the right of the\n  allocated 8-byte region in the kmalloc-8 cache"
          }
        ],
        "id": "CVE-2026-89778",
        "lastModified": "2026-09-16T15:18:07.167",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T09:17:08.253",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68d4d3e78150c7ed7d1195af63ad1e6ace30c661"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85904076cece72ee3194646ad7ac8e6659d999aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8b994ac5778a725982fd6a8a3afcaa068d4a93e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c6eace8d07e90f038c89eb3b756d65a7e259d48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad3249cdf9d4ba34bb8b1ff3956a4020fdfb5b0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd616aa0449a772a6956abf03358f0ff31720580"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f03425dcbe04aec3c27b9917e97d7d23a2908dda"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-17T16:39:37Z",
      "cve": "CVE-2026-89778",
      "id": "CVE-2026-89778",
      "initial_release_date": "2026-09-16T15:35:51Z",
      "product_status:known_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89778",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89778.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.