kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)

Overview

A flaw was found in the Linux kernel's ucs2_strnlen() function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not properly terminated within the specified bounds, an attacker could potentially trigger an out-of-bounds read, which may lead to information disclosure or a denial of service.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · vex

kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-21.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Not affected:

• Red Hat Enterprise Linux 6

Remediation

Fix deferred