CVE-2026-89552: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-gmqc-x8hx-2ggc
Share
Published
Advisory Summary

CVE-2026-89552 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89552 at a Glance

CVE Identifier CVE-2026-89552
GHSA Identifier GHSA-gmqc-x8hx-2ggc
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89552

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89552, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL. Failing zswap's compressor update before zswap is initialized can later trigger: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswap_setup+0x3b1/0x490 zswap_enabled_param_set+0x5b/0xa0 param_attr_store+0x93/0xe0 module_attr_store+0x1c/0x30 kernfs_fop_write_iter+0x116/0x1f0 Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.

References

NVD — CVE-2026-89552 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89552
git.kernel.org/stable/c/0d8e240492... WEB
https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896
git.kernel.org/stable/c/3dfaae0424... WEB
https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae
git.kernel.org/stable/c/614f873268... WEB
https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359
git.kernel.org/stable/c/704ecd010d... WEB
https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0

Frequently Asked Questions

What is CVE-2026-89552?
CVE-2026-89552 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89552?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89552?
CVE-2026-89552 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89552?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gmqc-x8hx-2ggc",
  "modified" : "2026-09-11T21:31:32Z",
  "published" : "2026-09-11T21:31:32Z",
  "aliases" : [ "CVE-2026-89552" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nparams: fix charp corruption on allocation failure\n\nparam_set_charp() stores charp parameters in allocated memory after slab is\navailable, and releases the previous value when the parameter is updated.\n\nThe previous value is released before the replacement allocation succeeds.\nIf kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter\nleft as NULL.\n\nFailing zswap's compressor update before zswap is initialized can later\ntrigger:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:strcmp+0x10/0x30\n  Call Trace:\n    zswap_setup+0x3b1/0x490\n    zswap_enabled_param_set+0x5b/0xa0\n    param_attr_store+0x93/0xe0\n    module_attr_store+0x1c/0x30\n    kernfs_fop_write_iter+0x116/0x1f0\n\nAllocate and copy the replacement first, then replace the parameter value\nonly after allocation succeeds.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89552"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:38Z"
  }
}