CVE-2026-89749

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

Is your site exposed to CVE-2026-89749?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.12%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/12a499f741fc5be3731c8b0a0d909406575cc2eb https://git.kernel.org/stable/c/42ccb215ef0a552acbbd32f81009bfe4b278ba77 https://git.kernel.org/stable/c/649bc7df3e5d7be6f7996a95084037dbf3cad1e5 https://git.kernel.org/stable/c/98d06fb9865a490e12ebe32d65b9ffac6108614d https://git.kernel.org/stable/c/adadf4192f700bca82abfda9fa6d58c0bf37cc04 https://git.kernel.org/stable/c/c1a4fb7aa290f158d50654d640292e49d9055fd1 https://git.kernel.org/stable/c/c40e0b4fa365969e67011529eabdfb66d1022256 https://git.kernel.org/stable/c/ceb1707aef5824cf024eb82d10787b7621e2ff35

Frequently Asked Questions

What is CVE-2026-89749? +

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

How do I check if I'm vulnerable to CVE-2026-89749? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.