CVE intelligence

CVE-2026-89552

Vulnerability intelligence

Published Sep 11, 2026Sources checked Nov 3, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-89552. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-89552?

In the Linux kernel, the following vulnerability has been resolved:

params: fix charp corruption on allocation failure

param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated.

The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL.

Failing zswap's compressor update before zswap is initialized can later trigger:

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswap_setup+0x3b1/0x490 zswap_enabled_param_set+0x5b/0xa0 param_attr_store+0x93/0xe0 module_attr_store+0x1c/0x30 kernfs_fop_write_iter+0x116/0x1f0

Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.

Source: NVD