Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89596

forcedeth: fix off-by-one when saving/restoring non-PCI config space

CVSS 7.1 HighEPSS 0.0018 · 7th percentile

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before effd589568b2c4399894a23000286210c60af6d7 git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before 702aa4a44c87026b97b1da5c5ca80e1fa8a9875a git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before fc71c6c3d3e3bb17474dcd1162aea6783a452a64 git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before c4d5953582463f45e48b14ef9815e5fb636f7e1f git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before 9379f8527ca60d92715c90b32f1b477de9ec32cb git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before 0c3f4544ff3873594c8af1b907b4ac4e6d5ce005 git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before c4f196bfeedd71e56aba4b63bd8f919edb2f7056 git
  • affected 1a1ca86158eee303af5270338695f90bc7ae02b3 to before 9393f1d656a79693e0c123ff7bc7c5c0f708046d git
Other versions: unaffected
Linux Linux
  • affected 2.6.27
  • unaffected before 2.6.27 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.109 to 6.12.*, inclusive semver
  • unaffected 6.18.50 to 6.18.*, inclusive semver
  • unaffected 7.2.4 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89596
CNA
Linux
Tags
Published
11 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.1 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0018, the 7th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.