PatchSiren cyber security CVE debrief

CVE-2026-89169 Debian CVE debrief

The Debian live-boot package is vulnerable to a bypass of the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. This vulnerability affects Debian live-boot users and administrators, who should assess their exposure and verify the integrity of the .verity file in their installations. They should also apply patches or updates provided by Debian to fix the vulnerability. The CVE record and NVD entry provide limited information about the vulnerability.

Vendor: Debian
Product: live-boot
CVSS: MEDIUM 4.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-11
Original CVE updated: 2026-09-22
Advisory published: 2026-09-11
Advisory updated: 2026-09-22

Who should care

Debian live-boot users and administrators should assess their exposure and verify the integrity of the .verity file in their installations. They should also apply patches or updates provided by Debian to fix the vulnerability.

Why it matters

The CVE-2026-89169 vulnerability in Debian live-boot allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. Debian live-boot users and administrators should assess their exposure and verify the integrity of the .verity file in their installations. They should also apply patches or updates provided by Debian to fix the vulnerability.

Verify the integrity of the .verity file in Debian live-boot installations to prevent potential security incidents
Apply patches or updates provided by Debian to fix the vulnerability and prevent exploitation
Monitor Debian live-boot systems for potential security incidents and respond accordingly

Technical summary

The Debian live-boot package is vulnerable to a bypass of the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. This vulnerability has a CVSS score of 4.1 and a medium severity. The vulnerability allows attackers to bypass the protection mechanism, potentially leading to security incidents. Debian live-boot users and administrators should verify the integrity of the .verity file in their installations and apply patches or updates provided by Debian to fix the vulnerability.

Defensive priority

Medium priority for Debian live-boot users to verify and apply patches

Recommended defensive actions

Verify the integrity of the .verity file in Debian live-boot installations
Apply patches or updates provided by Debian to fix the vulnerability
Monitor Debian live-boot systems for potential security incidents

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Debian live-boot package is affected, and the vulnerability allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

Sources and references

Verified primary and authoritative sources

CVE-2026-89169 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-89169

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-89169 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89169

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://salsa.debian.org/live-team/live-boot/-/blob/ff8867c4e2d62e497cb895b15b7d6d518d5adff1/components/9990-overlay.sh

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.