CVE-2026-89994
Last modified
CVE-2026-89994 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid. Event injection can be used to trigger a crash: $ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace The log output needs only edma->membase.
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid. Event injection can be used to trigger a crash: $ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 11102d0c343ba06ddd303f2503c0ce46d70052f2, < ef02cd3807f39ae1dbc924788d8fa6a85334c435; >= 11102d0c343ba06ddd303f2503c0ce46d70052f2, < d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7; >= 11102d0c343ba06ddd303f2503c0ce46d70052f2, < 2a3801ae5c344473e648006c5b03a9216ac54a6a; >= 11102d0c343ba06ddd303f2503c0ce46d70052f2, < 2ea04dca8e627f722caa7a2037cfbae0257f3501 |
| Linux | Linux | 6.10 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-89994?
How severe is CVE-2026-89994?
How do I fix CVE-2026-89994?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89988In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89989In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89990In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-89991In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89992In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-89993In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89995In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-89996In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89997In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89998In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89999In the Linux kernel, the following vulnerability has been re…8.1
- CVE-2026-90000In the Linux kernel, the following vulnerability has been re…8.8
Are you affected by CVE-2026-89994?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST