CVE-2026-89556
NoneCVSS
—
EPSS
0.2%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A flaw in the way Linux checks certain parts inside program files could let specially made files cause crashes or security problems when the system tries to load them as kernel modules.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
The flaw permits dereferencing unvalidated offsets in ELF section headers for string tables (.shstrtab and .strtab) when their types are not SHT_STRTAB, leading to out-of-bounds memory access during module loading validation.
Why it matters to the business
Potential kernel instability or exploitation when loading untrusted kernel modules, increasing risk to system integrity and availability across Linux deployments.
How an attack unfolds
An attacker supplies a malicious ELF kernel module where string section headers have invalid types such as SHT_NULL, bypassing offset validation and causing invalid memory access when the kernel caches section strings during elf_validity_cache_secstrings or elf_validity_cache_strtab.
How to fix it
Apply the kernel patch that adds explicit SHT_STRTAB type validation for .shstrtab and .strtab headers before any offset caching occurs.
How to confirm the fix worked
Inspect the elf_validity_cache_sechdrs, elf_validity_cache_secstrings and elf_validity_cache_strtab functions in kernel module loader source to confirm SHT_STRTAB checks are present.
Typical attack path
- Craft a malicious ELF kernel module with non-STRTAB string sections that reference invalid offsets
- Trigger module loading via insmod or modprobe on the target system
- Reach the unvalidated string table caching paths that dereference out-of-bounds memory
How to detect it
Review kernel logs and audit trails for module load attempts that produce oops or warnings referencing ELF section header validation failures; correlate with attempts to insert modules from unexpected sources.
What your security team should do
- Prioritize kernel updates that include the string table type validation fix
- Enforce signed module loading and restrict unprivileged module insertion
The record
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory when dereferenced in elf_validity_cache_secstrings or elf_validity_cache_strtab. Validate that both string section headers are of type SHT_STRTAB before caching them.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|