CVE-2026-89759: Linux Linux

mm/kmemleak: avoid soft lockup when scanning task stacks

No CVSS scoreEPSS 0.0020 · 9th percentile

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:47 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 2567818c2776d0a820506c3612261d9e24af7164 git affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before f1cd6c4c35243377882c47236281d03ee3be6eeb git affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 9a1b12c06c192290b8479de48f66f1e75d89c4b7 git affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 3fc8044251de21555fb02c365fa681bab8b0db55 git affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 1838c704bcb4fd3556cf67513c6f97a39099e35c git affected c4b28963fd79457315783b3b0f21c01eb88cfdc1 to before 5d10d4e19e6daa487f0cd0ea6cba472325de92f9 git Other versions: unaffected
Linux	Linux	affected 5.10 unaffected before 5.10 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.109 to 6.12., inclusive semver unaffected 6.18.50 to 6.18., inclusive semver unaffected 7.2.4 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers

CVE-2026-89759

CNA

Linux

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Linux kernel versions from commit c4b28963fd79457315783b3b0f21c01eb88cfdc1 onward, up to the listed fixed commits, are affected, along with 5.10 and later kernels before the stable fixes. The kmemleak scanner could hold a CPU long enough on hosts with very many threads to trigger the soft lockup watchdog. The source gives few details about how an attacker would trigger it, and no attacker capability is described. Upgrade to a fixed kernel version from the stable branches (6.1.191, 6.6.160, 6.12.109, or 6.18.50 and later), or to a mainline release that includes the fix.

Written 12 Nov 2026.

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0020, the 9th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.