# CVE-2026-89992

Kernel cpuidle frees wrong pointer, causing heap corruption.

- Page: https://www.vulneraibility.com/cve/CVE-2026-89992
- CVSS: 8.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.18% (percentile 7.6)
- Published: 2026-09-16

## Affected versions

- Linux: affected >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < 1312ae33b91430ec99e69cd3d47f0e50a4ebf54b; >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < a38caa9ed0d5c61c17d88393b14b292199289c1f; >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < 09d002c8fb0261d35ce9d8a705de5db034ee90b8; >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < b519dfce1998c323e54a56f911cf708d9ba0e076; >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < 3394c7ba23336bdb7ece29127130fd01731d42d8; >= 9d976d6721dfb525b81ce981e1363c70c0975aab and < 2b0ac85512b7f67479127b2713254490662eb13d; 5.18; fixed in < 5.18, >= 6.1.188 and <= 6.1.*, >= 6.6.157 and <= 6.6.*, >= 6.12.110 and <= 6.12.*, >= 6.18.51 and <= 6.18.*, >= 7.2.5 and <= 7.2.*, >= 7.3-rc2 and <= *

A version outside these ranges is not a statement that it is unaffected.

## Impact

Local attacker can trigger kernel heap corruption leading to crashes, local privilege escalation or arbitrary kernel code execution.

## Action

Patch when possible

## Recommendation

Apply vendor/kernel updates and reboot; restrict untrusted local access.

## References

- [other] https://git.kernel.org/stable/c/1312ae33b91430ec99e69cd3d47f0e50a4ebf54b
- [other] https://git.kernel.org/stable/c/a38caa9ed0d5c61c17d88393b14b292199289c1f
- [other] https://git.kernel.org/stable/c/09d002c8fb0261d35ce9d8a705de5db034ee90b8
- [other] https://git.kernel.org/stable/c/b519dfce1998c323e54a56f911cf708d9ba0e076
- [other] https://git.kernel.org/stable/c/3394c7ba23336bdb7ece29127130fd01731d42d8
- [other] https://git.kernel.org/stable/c/2b0ac85512b7f67479127b2713254490662eb13d

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.