CVE-2026-89731 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems, especially those utilizing the cxl/ras component, should assess their exposure and prioritize verification and remediation efforts.

Why it matters

This vulnerability in the Linux kernel's cxl/ras component could lead to out-of-bounds reads, potentially disclosing sensitive information. Linux kernel maintainers, distribution maintainers, and end-users should assess exposure, especially if using the affected component, and prioritize patching.

• Potential out-of-bounds reads could lead to information disclosure.
• Successful exploitation requires local access and low privileges.
• Remediation involves applying kernel patches; priority should be given to systems with elevated risk profiles.

Technical summary

The cxl_rch_get_aer_info() function in the Linux kernel was reading beyond the bounds of the AER register block. This was due to the sizeof(struct aer_capability_regs) being larger than the physical AER capability. The fix ensures the read is bounded to the physical AER registers and zeros the software-only fields. This change prevents out-of-bounds reads and potential information disclosure. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those utilizing the cxl/ras component.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those utilizing the cxl/ras component.

Recommended defensive actions

• Review Linux kernel patching and update processes to ensure affected systems are remediated.
• Verify system configurations and inventory to identify potential exposure.
• Monitor for any subsequent advisories or patches related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Four source references from the Linux kernel Git repository are available, detailing the patches addressing the issue. The fix ensures the read is bounded to the physical AER registers and zeros the software-only fields. This change prevents out-of-bounds reads and potential information disclosure. Linux kernel maintainers, distribution maintainers, and end-users should assess exposure, especially if using the affected component, and prioritize patching. The evidence,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.