{"id":"CVE-2026-89602","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown. If a resize fails after som…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= d6db47e571dcaecaeaafa8840d00ae849ae3907b < 3fbdd15d5830f52661eb78be95058d101cb0c2cb","Linux >= d6db47e571dcaecaeaafa8840d00ae849ae3907b < 7267557ce98ccd07faaf3bc86382448950cc4ff6","Linux >= d6db47e571dcaecaeaafa8840d00ae849ae3907b < 7f4a89d4f0d6acaf4b756c31de48f2109a257b70","Linux >= d6db47e571dcaecaeaafa8840d00ae849ae3907b < a7d097cf01301c5da37927c8f26123d006f0fd8a","Linux 6.10"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:23.817","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89602","references":[{"url":"https://git.kernel.org/stable/c/3fbdd15d5830f52661eb78be95058d101cb0c2cb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7267557ce98ccd07faaf3bc86382448950cc4ff6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f4a89d4f0d6acaf4b756c31de48f2109a257b70","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7d097cf01301c5da37927c8f26123d006f0fd8a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89602.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89602"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532403"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89602"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89602"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89602.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00172,"epssPercentile":0.06888,"scores":{"nvd":7.8,"cna":7.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.474Z","slug":"CVE-2026-89602","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: skip sufficiently large global buffers when resizing\n\nz_erofs_gbuf_nrpages is advanced only after every global buffer has been\ngrown. If a resize fails after some buffers were enlarged, a retry\nrevisits those enlarged buffers.\n\nRetrying the same size then returns -ENOMEM because alloc_pages_bulk()\nhas no pages to add and the unchanged return value is treated as a\nfailure. Retrying an intermediate size allocates a temporary pointer\narray smaller than gbuf->nrpages and copies more existing pointers than\nthe array can hold.\n\nSkip buffers that already satisfy the request. Once all remaining\nbuffers have caught up, advancing z_erofs_gbuf_nrpages again describes\nthe guaranteed minimum size across the pool.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89602.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208384,"id":"CVE-2026-89602","ts":1789997914605,"field":"cvss","old":"7","new":"7.8"},{"seq":208131,"id":"CVE-2026-89602","ts":1789922722534,"field":"cvss","old":"6","new":"7"},{"seq":208130,"id":"CVE-2026-89602","ts":1789922722534,"field":"severity","old":"medium","new":"high"},{"seq":202863,"id":"CVE-2026-89602","ts":1789403732716,"field":"cvss","old":"7.8","new":"6"},{"seq":202862,"id":"CVE-2026-89602","ts":1789403732716,"field":"severity","old":"high","new":"medium"},{"seq":197869,"id":"CVE-2026-89602","ts":1789384320743,"field":"cvss","old":"6","new":"7.8"},{"seq":197868,"id":"CVE-2026-89602","ts":1789384320743,"field":"severity","old":"medium","new":"high"},{"seq":183423,"id":"CVE-2026-89602","ts":1789356675309,"field":"cvss","old":"7.8","new":"6"},{"seq":183422,"id":"CVE-2026-89602","ts":1789356675309,"field":"severity","old":"high","new":"medium"},{"seq":153424,"id":"CVE-2026-89602","ts":1789285350456,"field":"cvss","old":null,"new":"7.8"},{"seq":153423,"id":"CVE-2026-89602","ts":1789285350456,"field":"severity","old":"none","new":"high"},{"seq":147263,"id":"CVE-2026-89602","ts":1789270205383,"field":"cvss","old":null,"new":"6"},{"seq":147262,"id":"CVE-2026-89602","ts":1789270205383,"field":"severity","old":"none","new":"medium"},{"seq":109014,"id":"CVE-2026-89602","ts":1789183729954,"field":"cvss","old":null,"new":"6"},{"seq":109013,"id":"CVE-2026-89602","ts":1789183729954,"field":"severity","old":"none","new":"medium"}]}