CVE-2026-89981: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-x8h3-pr46-6w2j
Share
Published
Advisory Summary

CVE-2026-89981 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-89981 at a Glance

CVE Identifier CVE-2026-89981
GHSA Identifier GHSA-x8h3-pr46-6w2j
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-89981

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-89981, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too.

References

NVD — CVE-2026-89981 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89981
git.kernel.org/stable/c/5445d64199... WEB
https://git.kernel.org/stable/c/5445d64199626974269fcdf347769ad44b0bb53b
git.kernel.org/stable/c/d2d22ff377... WEB
https://git.kernel.org/stable/c/d2d22ff377cd43f2e9660426ff22e3cd4c534637

Frequently Asked Questions

What is CVE-2026-89981?
CVE-2026-89981 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-89981?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-89981?
CVE-2026-89981 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-89981?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x8h3-pr46-6w2j",
  "modified" : "2026-09-16T12:30:43Z",
  "published" : "2026-09-16T12:30:43Z",
  "aliases" : [ "CVE-2026-89981" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don't read GMID_EL1 when MTE is disabled\n\n__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw\nID_AA64PFR1_EL1, so it reads the register even when the kernel has\ndisabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5\nin that case, and pKVM injects an UNDEF the host cannot handle:\n\n  Internal error: Oops - Undefined instruction: 0000000002000000 [#1]  SMP\n  pc : __cpuinfo_store_cpu+0xf4/0x264\n  Kernel panic - not syncing: Attempted to kill the idle task!\n\nOnly pKVM reaches it, and only after a CPU is offlined and brought back\nonline: its CPU_ON relay sets the host HCR before the CPU enters EL1,\nwhile plain nVHE sets it at CPUHP_AP_KVM_ONLINE.\n\nGate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line\noverride applied, and on CONFIG_ARM64_MTE, which no register reflects.\nThe boot CPU stores its registers before init_cpu_features() strips an\nunsafe override, so clamp against the hardware value here too.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89981"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5445d64199626974269fcdf347769ad44b0bb53b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d2d22ff377cd43f2e9660426ff22e3cd4c534637"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:17:09Z"
  }
}