CVE-2026-89743Medium· 5.5▾ SunlitA flaw was found in the Linux kernel's Network Shared Memory (NSM) component. A malicious or buggy backend can report a response length larger than the allocated buffer. This can lead to an out-of-bounds read, disclosing adjacent kernel me…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 6.3
— → 6.3
none → medium
— → 7.7
none → high
7.7 → 6.3
high → medium
6.3 → 7.7
medium → high
7.7 → 6.3
high → medium
Last analysed / modified upstream
6.3 → 5.5
A flaw was found in the Linux kernel's Network Shared Memory (NSM) component. A malicious or buggy backend can report a response length larger than the allocated buffer. This can lead to an out-of-bounds read, disclosing adjacent kernel memory to user space. This vulnerability results in information disclosure.
kernel: misc: nsm: bound the device-reported response length — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-21.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80958Medium· 5.5kernel: dm-pcache: clamp the tail kset read to the segment data region (CVE-2026-80958)
CVE-2026-80959Medium· 5.5kernel: dm-pcache: bound the persisted tail-position offset (CVE-2026-80959)
CVE-2026-80962Medium· 5.5kernel: dm-pcache: validate geometry fields from on-disk cache_info (CVE-2026-80962)
CVE-2026-89571Medium· 5.5kernel: cxl/features: bound fwctl command payload to the input buffer (CVE-2026-89571)
CVE-2026-89614Medium· 5.5kernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)