CVE-2026-89801: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-8x7w-6563-2c2q
Share
CVSS 7.8
Published
Advisory Summary

CVE-2026-89801 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89801 at a Glance

CVE Identifier CVE-2026-89801
GHSA Identifier GHSA-8x7w-6563-2c2q
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-89801

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89801, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set from nouveau_uvma_region_find(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure. The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears op->reg; these two do not. unwind_continue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup() then enters its if (op->reg) branch and calls nouveau_uvma_region_remove() and nouveau_uvma_region_put() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure. This frees a live region on an unrelated failure, reachable single-job when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths.

References

NVD — CVE-2026-89801 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89801
git.kernel.org/stable/c/24c25b182d... WEB
https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc
git.kernel.org/stable/c/4083d24c26... WEB
https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57
git.kernel.org/stable/c/88114e3a96... WEB
https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c
git.kernel.org/stable/c/ba42d8a1c2... WEB
https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb
git.kernel.org/stable/c/ccf930812f... WEB
https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a

Frequently Asked Questions

What is CVE-2026-89801?
CVE-2026-89801 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89801?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-89801?
CVE-2026-89801 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-89801?
CVE-2026-89801 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89801?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8x7w-6563-2c2q",
  "modified" : "2026-09-16T15:30:57Z",
  "published" : "2026-09-16T12:30:36Z",
  "aliases" : [ "CVE-2026-89801" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89801"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:16:44Z"
  }
}