CVE-2026-89556

module: validate string table section types

Published Sep 11, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

module: validate string table section types

In elf_validity_cache_sechdrs, section sizes and offsets are validated,
unless the section type is SHT_NULL or SHT_NOBITS.

Later, elf_validity_cache_secstrings and elf_validity_cache_index_str
access the section name table (.shstrtab) and symbol string table
(.strtab) headers without first ensuring that their types are
SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has
not been validated and may reference out-of-bounds memory when
dereferenced in elf_validity_cache_secstrings or
elf_validity_cache_strtab.

Validate that both string section headers are of type SHT_STRTAB before
caching them.

Analysis

Technical impact

The flaw resides in the Linux kernel’s ELF parsing logic that fails to validate that string table sections are of type SHT_STRTAB before accessing their offsets. As a result, the kernel can read beyond the bounds of the section header data when a section of type SHT_NULL or SHT_NOBITS is encountered, potentially leaking kernel memory contents. The weakness is classified as CWE-125.

Affected Systems

All Linux kernel builds that contain the unpatched elf_validity_cache implementation are affected.

Risk and Exploitability

The CVSS score is 4.7 and the EPSS low overall risk level. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred: an attacker would need to load a malicious ELF module, which normally requires elevated or privileged access. Therefore, unless an adversary can obtain administrative rights, exploitation is probably confined to local or privileged contexts and is considered unlikely in most deployments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f19f1a1c5fe56274e95b342e8138f4b774febf97`	affected	< db07e9b0320e480f05f5c12e8e4d6699f0d3acb7
`c92aab819d56d51631f0484ed7af11d9d8ff4cb0`	affected	< 50d0aa7d25ba4bc3606f150cd69755068e79f97f
`c92aab819d56d51631f0484ed7af11d9d8ff4cb0`	affected	< e4496dda2c6d0acf7ba5fbce14a2723a8935ceee
`c92aab819d56d51631f0484ed7af11d9d8ff4cb0`	affected	< 9a5ff45689329835f874cefe5174e577d141d423

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50d0aa7d25ba4bc3606f150cd69755068e79f97f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e4496dda2c6d0acf7ba5fbce14a2723a8935ceee)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9a5ff45689329835f874cefe5174e577d141d423)`	affected	code_commit	—
`[0,6.18.50)`	affected	semver	—
`[0,7.2.4)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the SHT_STRTAB validation to mitigate the out-of-bounds read.
Audit the system to ensure only signed or trusted modules are loaded and remove any that were present before the update, thereby preventing potential exploitation of the unvalidated string table sections (CWE-125).
Restrict module loading privileges to trusted users only by disabling unsigned module loading and enforcing module signature checks (e.g., set module.sig_enable=1 and limit CAP_SYS_MODULE) to reduce the risk of abusing the out-of-bounds read (CWE-125).

Generated by OpenCVE AI on September 15, 2026 at 22:30 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/50d0aa7d25ba4bc3606f150cd69755068e79f97f
https://git.kernel.org/stable/c/9a5ff45689329835f874cefe5174e577d141d423
https://git.kernel.org/stable/c/db07e9b0320e480f05f5c12e8e4d6699f0d3acb7
https://git.kernel.org/stable/c/e4496dda2c6d0acf7ba5fbce14a2723a8935ceee
https://nvd.nist.gov/vuln/detail/CVE-2026-89556
https://www.cve.org/CVERecord?id=CVE-2026-89556

History

Nov 10, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/db07e9b0320e480f05f5c12e8e4d6699f0d3acb7

Sep 12, 2026 3:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-20

Sep 12, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89556 https://www.cve.org/CVERecord?id=CVE-2026-89556
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 10:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-20

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory when dereferenced in elf_validity_cache_secstrings or elf_validity_cache_strtab. Validate that both string section headers are of type SHT_STRTAB before caching them.
Title		module: validate string table section types
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/50d0aa7d25ba4bc3606f150cd69755068e79f97f https://git.kernel.org/stable/c/9a5ff45689329835f874cefe5174e577d141d423 https://git.kernel.org/stable/c/e4496dda2c6d0acf7ba5fbce14a2723a8935ceee