CVE-2026-89449

UNRATEDCVSS · not yet scoredTrending — 3 sources updated this week
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: 0.2%CVSS v2: —Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

iommu_mock_device_add() first calls iommu_fwspec_init(), which on success allocates both dev->iommu (via dev_iommu_get()) and dev->iommu->fwspec. If the subsequent device_add(dev) call fails, the error path only calls iommu_fwspec_free(dev), which frees fwspec but leaves dev->iommu still allocated.

This triggers the following kmemleak report when fuzzing with Syzkaller:

BUG: memory leak unreferenced object 0xffff888011e0a200 (size 192): comm "syz.1.1695", pid 24885, jiffies 4295222527 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 25df5bb3): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4575 [inline] slab_alloc_node mm/slub.c:4899 [inline] __kmalloc_cache_noprof+0x47a/0x710 mm/slub.c:5415 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] dev_iommu_get+0x10c/0x1a0 drivers/iommu/iommu.c:408 iommu_fwspec_init+0x288/0x4d0 drivers/iommu/iommu.c:3087 iommu_mock_device_add+0x46/0xb0 drivers/iommu/iommu.c:385 mock_dev_create drivers/iommu/iommufd/selftest.c:1025 [inline] iommufd_test_mock_domain drivers/iommu/iommufd/selftest.c:1066 [inline] iommufd_test+0x2f8a/0x6190 drivers/iommu/iommufd/selftest.c:2072 iommufd_fops_ioctl+0x367/0x540 drivers/iommu/iommufd/main.c:533 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev) in the device_add() failure path. dev_iommu_free() frees both fwspec and the outer dev_iommu struct and clears dev->iommu.

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
0.2%
EPSS %ILE
9th
KEV
Not listed

BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

September 11, 2026

Last Modified

September 11, 2026

References (3)

Vendor Advisories for CVE-2026-89449(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Debian:14(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 7.2~rc7-1~exp1 (178 versions)
  • every version up to 7.2.6-1: fixed in 7.2.6-1
—

Data Freshness Timeline

(refreshed 12× in last 7d / 40× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

  1. 2026-10-13 16:35 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  2. 2026-10-12 16:35 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  3. 2026-10-12 14:48 UTCEG score recompute
  4. 2026-10-11 19:15 UTCEG score recompute
  5. 2026-10-11 16:32 UTCEG score recompute
  6. 2026-10-11 13:49 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  7. 2026-10-11 13:48 UTCEG score recompute
  8. 2026-10-10 20:00 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  9. 2026-10-09 22:21 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  10. 2026-10-09 20:07 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  11. 2026-10-08 17:13 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  12. 2026-10-07 23:48 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  13. 2026-10-06 19:30 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  14. 2026-10-06 15:18 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  15. 2026-10-05 17:44 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  16. 2026-10-04 23:22 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  17. 2026-10-03 16:40 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  18. 2026-10-01 19:51 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  19. 2026-09-30 15:04 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  20. 2026-09-30 13:50 UTCEG score recompute
  21. 2026-09-30 13:50 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  22. 2026-09-28 13:52 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  23. 2026-09-27 13:48 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  24. 2026-09-27 10:58 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  25. 2026-09-26 15:59 UTCEPSS rescoreEPSS 0.2% · 9th percentile
Show 20 more
  1. 2026-09-24 14:04 UTCEPSS rescoreEPSS 0.2% · 9th percentile
  2. 2026-09-24 08:08 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  3. 2026-09-23 17:54 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  4. 2026-09-22 16:01 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  5. 2026-09-21 21:09 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  6. 2026-09-21 05:18 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  7. 2026-09-20 20:16 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  8. 2026-09-18 19:28 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  9. 2026-09-18 02:25 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  10. 2026-09-17 19:32 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  11. 2026-09-16 14:09 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  12. 2026-09-16 05:15 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  13. 2026-09-15 03:12 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  14. 2026-09-14 23:35 UTCEG score recompute
  15. 2026-09-14 23:35 UTCGHSA enrichmentGHSA-3365-g9v5-8jg9
  16. 2026-09-13 16:48 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  17. 2026-09-12 15:02 UTCEPSS rescoreEPSS 0.2% · 6th percentile
  18. 2026-09-11 20:36 UTCNVD update
  19. 2026-09-11 19:52 UTCEG score recompute
  20. 2026-09-11 19:49 UTCMITRE cvelistV5first tracked

Frequently asked(4)

What is CVE-2026-89449?
CVE-2026-89449 is a vulnerability whose severity is not yet rated; its CVE record was published on September 11, 2026. In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdevice_add iommumockdeviceadd() first calls iommufwspec_init(), which on success allocates both dev->iommu (via deviommuget()) and dev->iommu->fwspec. If the…
When was the CVE record for CVE-2026-89449 published?
The CVE record for CVE-2026-89449 was published on September 11, 2026. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of September 11, 2026; the record at its source may have been updated since.
Is CVE-2026-89449 actively exploited?
CVE-2026-89449 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.2% probability of exploitation in the next 30 days (9th percentile of EPSS-scored CVEs).
How do I remediate CVE-2026-89449?
A fix for CVE-2026-89449 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-89449 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-89449

Explore →

Is Your Infrastructure Affected by CVE-2026-89449?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs