CVE-2026-89515: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-c4r4-q33m-rp34
Share
Published
Advisory Summary

CVE-2026-89515 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89515 at a Glance

CVE Identifier CVE-2026-89515
GHSA Identifier GHSA-c4r4-q33m-rp34
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89515

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89515, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310 __dma_map_sg_attrs+0x217/0x310 dma_map_sg_attrs+0x4a/0x70 ata_qc_issue+0x9f8/0x1420 __ata_scsi_queuecmd+0x1657/0x1740 ata_scsi_queuecmd+0x79a/0x920 scsi_queue_rq+0x4472/0x4f40 blk_mq_dispatch_rq_list+0x1cca/0x3ee0 __blk_mq_sched_dispatch_requests+0x458/0x630 blk_mq_sched_dispatch_requests+0x15b/0x340 __blk_mq_run_hw_queue+0xe5/0x250 __blk_mq_delay_run_hw_queue+0x138/0x780 blk_mq_run_hw_queue+0x4bb/0x7e0 blk_mq_sched_insert_request+0x2a7/0x4c0 blk_execute_rq+0x497/0x8a0 sg_io+0xbe0/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Uninit was created at: __alloc_pages+0x5c0/0xc80 alloc_pages+0xe0e/0x1050 blk_rq_map_user_iov+0x2b77/0x6100 blk_rq_map_user_io+0x2fa/0x4d0 sg_io+0xad6/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem. Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

References

NVD — CVE-2026-89515 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89515
git.kernel.org/stable/c/1aa6df61ce... WEB
https://git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1
git.kernel.org/stable/c/28ed534366... WEB
https://git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff
git.kernel.org/stable/c/626147717b... WEB
https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4
git.kernel.org/stable/c/6da140ebdf... WEB
https://git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8
git.kernel.org/stable/c/6fd1cce501... WEB
https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409
git.kernel.org/stable/c/a4353ec774... WEB
https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51
git.kernel.org/stable/c/e7143c3f4e... WEB
https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264
git.kernel.org/stable/c/fd2cbe08c6... WEB
https://git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c

Frequently Asked Questions

What is CVE-2026-89515?
CVE-2026-89515 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89515?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89515?
CVE-2026-89515 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89515?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c4r4-q33m-rp34",
  "modified" : "2026-09-14T15:32:27Z",
  "published" : "2026-09-11T21:31:30Z",
  "aliases" : [ "CVE-2026-89515" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()\n\nDuring fuzz testing, the following issue was discovered:\n\nBUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310\n __dma_map_sg_attrs+0x217/0x310\n dma_map_sg_attrs+0x4a/0x70\n ata_qc_issue+0x9f8/0x1420\n __ata_scsi_queuecmd+0x1657/0x1740\n ata_scsi_queuecmd+0x79a/0x920\n scsi_queue_rq+0x4472/0x4f40\n blk_mq_dispatch_rq_list+0x1cca/0x3ee0\n __blk_mq_sched_dispatch_requests+0x458/0x630\n blk_mq_sched_dispatch_requests+0x15b/0x340\n __blk_mq_run_hw_queue+0xe5/0x250\n __blk_mq_delay_run_hw_queue+0x138/0x780\n blk_mq_run_hw_queue+0x4bb/0x7e0\n blk_mq_sched_insert_request+0x2a7/0x4c0\n blk_execute_rq+0x497/0x8a0\n sg_io+0xbe0/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nUninit was created at:\n __alloc_pages+0x5c0/0xc80\n alloc_pages+0xe0e/0x1050\n blk_rq_map_user_iov+0x2b77/0x6100\n blk_rq_map_user_io+0x2fa/0x4d0\n sg_io+0xad6/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nBytes 14-15 of 16 are uninitialized\nMemory access of size 16 starts at ffff88800cbdb000\n\nWhen processing the last unaligned element of the scatterlist, it is\nsupplemented with missing bytes in the amount of pad_len.  These bytes\nremain uninitialized, which leads to a problem.\n\nExtend last_sg->length by pad_len first, then use sg_zero_buffer() to\nzero those pad_len bytes.  sg_zero_buffer() uses sg_miter internally,\nwhich correctly handles sg entries spanning multiple pages and padding\nthat crosses a page boundary.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89515"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:34Z"
  }
}