---
id: CVE-2026-89726
title: >-
  kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
  (CVE-2026-89726)
summary: >-
  A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This
  vulnerability occurs because the function checks the current character before
  verifying if the maximum allowed length has been reached. If the input string
  is not prope…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T17:24:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89726'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532261'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89726'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89726'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89726.mbox
  - url: 'https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be'
  - url: 'https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc'
  - url: 'https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b'
  - url: 'https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78'
  - url: 'https://git.kernel.org/stable/c/04ae68af4107600120c3c41c94268f43bc350d48'
  - url: 'https://git.kernel.org/stable/c/2e5a70a175f0c74e7238b013a96c4eabc3002934'
  - url: 'https://git.kernel.org/stable/c/3ada20e110bf3245edb0a3bcddadc33d0f142f8d'
  - url: 'https://git.kernel.org/stable/c/60c74f42f5abddb85dd919b4448d5474e65dbe76'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00177
epssPercentile: 0.06545
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not properly terminated within the specified bounds, an attacker could potentially trigger an out-of-bounds read, which may lead to information disclosure or a denial of service.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json)

**kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-21.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

Not affected:

- Red Hat Enterprise Linux 6

## Remediation

Fix deferred