{"id":"CVE-2026-89726","title":"kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)","summary":"A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not prope…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-09-11","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:24:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89726"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532261"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89726"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89726"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89726.mbox"},{"url":"https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be"},{"url":"https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc"},{"url":"https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b"},{"url":"https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78"},{"url":"https://git.kernel.org/stable/c/04ae68af4107600120c3c41c94268f43bc350d48"},{"url":"https://git.kernel.org/stable/c/2e5a70a175f0c74e7238b013a96c4eabc3002934"},{"url":"https://git.kernel.org/stable/c/3ada20e110bf3245edb0a3bcddadc33d0f142f8d"},{"url":"https://git.kernel.org/stable/c/60c74f42f5abddb85dd919b4448d5474e65dbe76"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00177,"epssPercentile":0.07503,"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89726","body":"## Overview\n\nA flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not properly terminated within the specified bounds, an attacker could potentially trigger an out-of-bounds read, which may lead to information disclosure or a denial of service.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json)\n\n**kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-21.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208963,"id":"CVE-2026-89726","ts":1790062301025,"field":"cvss","old":"5.3","new":"5.5"},{"seq":204027,"id":"CVE-2026-89726","ts":1789490231107,"field":"cvss","old":null,"new":"5.3"},{"seq":204026,"id":"CVE-2026-89726","ts":1789490231107,"field":"severity","old":"none","new":"medium"},{"seq":147472,"id":"CVE-2026-89726","ts":1789270211042,"field":"cvss","old":null,"new":"5.3"},{"seq":147471,"id":"CVE-2026-89726","ts":1789270211042,"field":"severity","old":"none","new":"medium"},{"seq":109228,"id":"CVE-2026-89726","ts":1789183731025,"field":"cvss","old":null,"new":"5.3"},{"seq":109227,"id":"CVE-2026-89726","ts":1789183731025,"field":"severity","old":"none","new":"medium"}]}