# mm/kmemleak: avoid soft lockup when scanning task stacks

CVE record · `CVE-2026-89759`

- **Identifiers:** `CVE-2026-89759`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 11 Sept 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:47 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 2567818c2776d0a820506c3612261d9e24af7164` (git)
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before f1cd6c4c35243377882c47236281d03ee3be6eeb` (git)
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 9a1b12c06c192290b8479de48f66f1e75d89c4b7` (git)
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 3fc8044251de21555fb02c365fa681bab8b0db55` (git)
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 1838c704bcb4fd3556cf67513c6f97a39099e35c` (git)
  - affected: `c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 5d10d4e19e6daa487f0cd0ea6cba472325de92f9` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.10`
  - unaffected: `before 5.10` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.109 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.50 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.4 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

> Linux kernel versions from commit c4b28963fd79457315783b3b0f21c01eb88cfdc1 onward, up to the listed fixed commits, are affected, along with 5.10 and later kernels before the stable fixes. The kmemleak scanner could hold a CPU long enough on hosts with very many threads to trigger the soft lockup watchdog. The source gives few details about how an attacker would trigger it, and no attacker capability is described. Upgrade to a fixed kernel version from the stable branches (6.1.191, 6.6.160, 6.12.109, or 6.18.50 and later), or to a mainline release that includes the fix.

Written 12 Nov 2026.

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0020, the 9th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89759](https://www.cve.org/CVERecord?id=CVE-2026-89759)
- [NVD: CVE-2026-89759](https://nvd.nist.gov/vuln/detail/CVE-2026-89759)

### References from the CNA

- <https://git.kernel.org/stable/c/2567818c2776d0a820506c3612261d9e24af7164>
- <https://git.kernel.org/stable/c/f1cd6c4c35243377882c47236281d03ee3be6eeb>
- <https://git.kernel.org/stable/c/9a1b12c06c192290b8479de48f66f1e75d89c4b7>
- <https://git.kernel.org/stable/c/3fc8044251de21555fb02c365fa681bab8b0db55>
- <https://git.kernel.org/stable/c/1838c704bcb4fd3556cf67513c6f97a39099e35c>
- <https://git.kernel.org/stable/c/5d10d4e19e6daa487f0cd0ea6cba472325de92f9>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89759>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89759/>. Everything for agents: <https://agentprime.io/llms.txt>.