CVE-2026-89449: Software Security Vulnerability Vulnerability

UNKNOWN

Advisory Identifier: GHSA-3365-g9v5-8jg9

Published 2026-09-11

Advisory Summary

CVE-2026-89449 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89449 at a Glance

CVE Identifier CVE-2026-89449

GHSA Identifier GHSA-3365-g9v5-8jg9

Severity N/A

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-09-11

Last Updated 2026-09-11

How to Fix CVE-2026-89449

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89449, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommu_mock_device_add() first calls iommu_fwspec_init(), which on success allocates both dev->iommu (via dev_iommu_get()) and dev->iommu->fwspec. If the subsequent device_add(dev) call fails, the error path only calls iommu_fwspec_free(dev), which frees fwspec but leaves dev->iommu still allocated. This triggers the following kmemleak report when fuzzing with Syzkaller: BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4575 [inline] slab_alloc_node mm/slub.c:4899 [inline] __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385 mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline] iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev) in the device_add() failure path. dev_iommu_free() frees both fwspec and the outer dev_iommu struct and clears dev->iommu.

References

NVD — CVE-2026-89449 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-89449

git.kernel.org/stable/c/b7b0b38514... WEB

https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5

git.kernel.org/stable/c/eaf44262af... WEB

https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370

git.kernel.org/stable/c/f80f3acb69... WEB

https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66

Frequently Asked Questions

What is CVE-2026-89449?

CVE-2026-89449 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-89449?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2026-89449?

CVE-2026-89449 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-89449?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3365-g9v5-8jg9",
  "modified" : "2026-09-11T21:31:26Z",
  "published" : "2026-09-11T21:31:26Z",
  "aliases" : [ "CVE-2026-89449" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add\n\niommu_mock_device_add() first calls iommu_fwspec_init(), which on\nsuccess allocates both dev->iommu (via dev_iommu_get()) and\ndev->iommu->fwspec. If the subsequent device_add(dev) call fails,\nthe error path only calls iommu_fwspec_free(dev), which frees\nfwspec but leaves dev->iommu still allocated.\n\nThis triggers the following kmemleak report when fuzzing with Syzkaller:\n\nBUG: memory leak\nunreferenced object 0xffff888011e0a200 (size 192):\n  comm \"syz.1.1695\", pid 24885, jiffies 4295222527\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de  .............N..\n    ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff  ................\n  backtrace (crc 25df5bb3):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4575 [inline]\n    slab_alloc_node mm/slub.c:4899 [inline]\n    __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415\n    kmalloc_noprof include/linux/slab.h:950 [inline]\n    kzalloc_noprof include/linux/slab.h:1188 [inline]\n    dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408\n    iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087\n    iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385\n    mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline]\n    iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline]\n    iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072\n    iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533\n    vfs_ioctl fs/ioctl.c:51 [inline]\n    __do_sys_ioctl fs/ioctl.c:597 [inline]\n    __se_sys_ioctl fs/ioctl.c:583 [inline]\n    __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)\nin the device_add() failure path. dev_iommu_free() frees both fwspec\nand the outer dev_iommu struct and clears dev->iommu.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89449"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b7b0b3851474883d4aba6ed72da87141204b23e5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eaf44262af24810d16800b988c92dfce90f73370"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f80f3acb69164800051ecdee871b6b006cbc2e66"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:25Z"
  }
}

Advisory Metadata

Source ID: GHSA-3365-g9v5-8jg9
Schema Version: 1.4.0
Published: 2026-09-11 21:31
Last Modified: 2026-09-11 21:31
Database Record File: advisories/unreviewed/2026/09/GHSA-3365-g9v5-8jg9/GHSA-3365-g9v5-8jg9.json