CVE-2026-89518: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-45rw-88gp-h7jx
Share
Published
Advisory Summary

CVE-2026-89518 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89518 at a Glance

CVE Identifier CVE-2026-89518
GHSA Identifier GHSA-45rw-88gp-h7jx
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89518

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89518, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix this_rq() assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch() may execute on a CPU different from the dispatched rq's. Several kfunc paths assumed the two always coincide: - scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s rq flags and lock-danced accordingly. A dispatch for a sibling took the unlocked-context branch and acquired the source rq lock on top of the already held dispatched rq lock which could deadlock. - scx_bpf_sub_dispatch() dispatched this_rq() with its stashed sub_dispatch_prev, which is NULL when dispatching for a sibling. - finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched rq's. The latter two are callable from other rq-locked operations too, where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes behavior also without core scheduling, e.g. for ops.enqueue() running a remote wakeup on the waking CPU, and is intended: which CPU happens to execute an operation is incidental, the op's rq is what it is operating on, and the resolution now matches the insert side where SCX_DSQ_LOCAL dispatches land on the task's rq. Use the rq tracked by scx_locked_rq(), which is set to the dispatched rq around ops invocations and NULL in unlocked contexts.

References

NVD — CVE-2026-89518 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89518
git.kernel.org/stable/c/3dd52416e4... WEB
https://git.kernel.org/stable/c/3dd52416e44a70bc993adb96d2e0d71b9ea21359
git.kernel.org/stable/c/6d1890d3c6... WEB
https://git.kernel.org/stable/c/6d1890d3c6137ab523799765ae2de62cc05f116d

Frequently Asked Questions

What is CVE-2026-89518?
CVE-2026-89518 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89518?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89518?
CVE-2026-89518 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89518?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-45rw-88gp-h7jx",
  "modified" : "2026-09-11T21:31:30Z",
  "published" : "2026-09-11T21:31:30Z",
  "aliases" : [ "CVE-2026-89518" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix this_rq() assumptions in dispatch kfuncs\n\nUnder core scheduling, dispatch runs from within the core-wide pick and can\ntarget a sibling rq, so ops.dispatch() may execute on a CPU different from\nthe dispatched rq's. Several kfunc paths assumed the two always coincide:\n\n- scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s\n  rq flags and lock-danced accordingly. A dispatch for a sibling took the\n  unlocked-context branch and acquired the source rq lock on top of the\n  already held dispatched rq lock which could deadlock.\n\n- scx_bpf_sub_dispatch() dispatched this_rq() with its stashed\n  sub_dispatch_prev, which is NULL when dispatching for a sibling.\n\n- finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued()\n  resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched\n  rq's. The latter two are callable from other rq-locked operations too,\n  where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes\n  behavior also without core scheduling, e.g. for ops.enqueue() running a\n  remote wakeup on the waking CPU, and is intended: which CPU happens to\n  execute an operation is incidental, the op's rq is what it is operating\n  on, and the resolution now matches the insert side where SCX_DSQ_LOCAL\n  dispatches land on the task's rq.\n\nUse the rq tracked by scx_locked_rq(), which is set to the dispatched rq\naround ops invocations and NULL in unlocked contexts.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89518"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3dd52416e44a70bc993adb96d2e0d71b9ea21359"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6d1890d3c6137ab523799765ae2de62cc05f116d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:34Z"
  }
}