Strix
64.2K

CVE-2026-89743

HIGHCVSS 7.7/10EPSS 0.17%

Last modified

CVE-2026-89743 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fill_req_raw(); the response path lacks the symmetric check. Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.

Metrics

CVSS 3.1
7.7/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Probability
0.17%

6.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= b9873755a6c8ccfce79094c4dce9efa3ecb1a749, < 339f19b9a6171289b0e797deb8bda80b9a1fcc30; >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749, < 29e634a18957acda11383a15ab98a91c4ae9e294; >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749, < 2aa0fb9c96f894a9c179a48e7522ea6705800adf; >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749, < 808e530654a5354e6df78863a5d61e4d44e67235
LinuxLinux6.8

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89743?
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len without bounding it to the response buffer. A malicious or buggy backend can report a length larger than the response buffer; parse_resp_raw() then copies that many bytes out of the fixed buffer to user space, disclosing adjacent kernel heap (an out-of-bounds read). The request path already floors its length in fill_req_raw(); the response path lacks the symmetric check. Clamp the stored length to the size of the response buffer. Well-behaved devices report no more than the posted buffer size, so conforming traffic is unaffected.
How severe is CVE-2026-89743?
CVE-2026-89743 has a CVSS score of 7.7/10 (HIGH severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89743?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89743?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST