CVE-2026-89555 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of systems that utilize MPLS should assess their exposure to this vulnerability and prioritize verification of affected systems, especially those using MPLS. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Why it matters

A use-after-free vulnerability in the Linux kernel's MPLS implementation requires verification of affected systems and prioritization of patching or updating.

• Verification of affected Linux kernel versions and MPLS usage is required to determine exposure.
• Potential denial-of-service (DoS) or code execution may occur if the vulnerability is exploited.
• Linux kernel developers and administrators should assess and prioritize patching or updating affected systems.

Technical summary

The Linux kernel's MPLS implementation has a use-after-free vulnerability. The `mpls_select_multipath` function caches the header for the current label while walking the MPLS label stack. However, after finding the bottom-of-stack label, it calls `pskb_may_pull` before reading the inner IP header. If the skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, `pskb_may_pull` calls `pskb_expand_head` to replace the skb head and free the old one. This leaves the cached header pointing to freed memory.

Defensive priority

Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems, especially those using MPLS.

Recommended defensive actions

• Review Linux kernel MPLS implementation for use-after-free vulnerability
• Verify affected systems, especially those using MPLS
• Apply patch or update Linux kernel to resolved version
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue was found through static analysis, and a reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs. This vulnerability affects Linux kernel versions and requires verification of MPLS usage. Defenders should verify affected systems, especially those using MPLS, and prioritize patching or updating.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.