CVE-2026-89587 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches or mitigations as necessary. Linux kernel developers and maintainers are responsible for reviewing and applying the provided kernel patches. Linux distribution vendors should ensure that their users have access to the patched versions. Users of Linux-based systems should verify the Linux kernel version and ensure it

Why it matters

The CVE-2026-89587 vulnerability in the Linux kernel's ACPI: pfr_update query_capability() function requires immediate attention from Linux kernel developers, maintainers, and users. A successful exploit could lead to local privilege escalation, denial of service, or arbitrary code execution. To mitigate this risk, it is essential to review and apply the provided kernel patches, implement additional monitoring and logging, and verify the Linux kernel version.

• Potential local privilege escalation
• Possible denial of service (DoS) via system crash
• Increased risk of arbitrary code execution
• Need for patch verification and deployment

Technical summary

The Linux kernel's ACPI: pfr_update query_capability() function is vulnerable to a stack buffer overflow. The function copies four ACPI buffer objects returned by the firmware into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length. If the firmware returns a buffer length greater than 16 for any of these fields, memcpy writes past the destination array, potentially allowing a local attacker to execute arbitrary code.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to address the stack buffer overflow vulnerability.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Verify the Linux kernel version and ensure it is up-to-date with the latest security patches.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was confirmed using KASAN on Linux kernel version 7.2-rc6. The issue arises from the memcpy function used to copy firmware-supplied buffer objects into fixed-size fields in the struct pfru_update_cap_info without proper length validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.