CVE-2026-89750: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-pf29-fjpw-v4g4
Share
CVSS 7.8
Published
Advisory Summary

CVE-2026-89750 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89750 at a Glance

CVE Identifier CVE-2026-89750
GHSA Identifier GHSA-pf29-fjpw-v4g4
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-89750

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89750, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0 Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.

References

NVD — CVE-2026-89750 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89750
git.kernel.org/stable/c/25a0758cf6... WEB
https://git.kernel.org/stable/c/25a0758cf6bdbfddac2be71124c9bd0692f4b0b1
git.kernel.org/stable/c/33ce55b368... WEB
https://git.kernel.org/stable/c/33ce55b368b64d65941867add00e7f288cbb8234
git.kernel.org/stable/c/390f6bd858... WEB
https://git.kernel.org/stable/c/390f6bd8583d177029d9df4bea6667509e55a765
git.kernel.org/stable/c/63b39e49a4... WEB
https://git.kernel.org/stable/c/63b39e49a4c9d68e010e96b26fc7374f0864f2b1
git.kernel.org/stable/c/b799f67119... WEB
https://git.kernel.org/stable/c/b799f67119aff179719a0b1e12441ebbdaaf62f9

Frequently Asked Questions

What is CVE-2026-89750?
CVE-2026-89750 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89750?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-89750?
CVE-2026-89750 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-89750?
CVE-2026-89750 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89750?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pf29-fjpw-v4g4",
  "modified" : "2026-09-14T15:32:36Z",
  "published" : "2026-09-11T21:31:39Z",
  "aliases" : [ "CVE-2026-89750" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Clear copied tracing state before fork duplication\n\ndup_task_struct() copies user_event_mm from the parent into the child,\nwithout grabbing a reference to it. user_event_mm_dup() should\nreplace it, but it leaves that copied pointer unmodified if\nuser_event_mm_alloc() fails.\n\nWhen the child exits, user_event_mm_remove() decrements a reference\nthe child never owned, which ultimately frees user_event_mm, while\nthe parent still as a stale pointer to it. This creates a UAF, which\nKASAN reports as:\n\n    BUG: KASAN: slab-use-after-free in\n    current_user_event_mm+0x51/0x1d0 Write of size 4 at addr\n    ffff888005010d30 by task init/44\n\n    Call Trace:\n     <TASK>\n     kasan_report+0xce/0x100\n     kasan_check_range+0x10f/0x1e0\n     current_user_event_mm+0x51/0x1d0\n     user_events_ioctl+0x82e/0x15c0\n     __x64_sys_ioctl+0x139/0x1c0\n     do_syscall_64+0xce/0x450\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n    Allocated by task 44:\n     __kasan_kmalloc+0x8f/0xa0\n     __kmalloc_cache_noprof+0x180/0x3a0\n     user_event_mm_alloc+0x3c/0x1f0\n     current_user_event_mm+0x88/0x1d0\n\n    Freed by task 42:\n     __kasan_slab_free+0x43/0x70\n     kfree+0x13a/0x390\n     process_one_work+0x696/0xf90\n     worker_thread+0x420/0xba0\n\nThe fix simply clears the copied pointer before any possible failure.\nIn case of failure, the child then has nothing to free.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89750"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/25a0758cf6bdbfddac2be71124c9bd0692f4b0b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/33ce55b368b64d65941867add00e7f288cbb8234"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/390f6bd8583d177029d9df4bea6667509e55a765"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/63b39e49a4c9d68e010e96b26fc7374f0864f2b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b799f67119aff179719a0b1e12441ebbdaaf62f9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:20:05Z"
  }
}