CVE-2026-89988

CVE-2026-89988 is a use-after-free race condition in the Linux kernel's kprobes subsystem: the function __within_kprobe_blacklist() walks the kprobe_blacklist list without holding kprobe_mutex, and when a module is unloaded, kprobe_remove_area_blacklist() removes its blacklist entries and frees them immediately with kfree(), so a concurrent blacklist check can dereference freed memory. The flaw is triggered whenever a kernel module is unloaded while another path checks the blacklist, including atomic or non-preemptible contexts where the sleeping mutex cannot even be taken. An attacker with local low-privilege access who can trigger module unloading alongside kprobe blacklist lookups could crash the kernel or potentially exploit the freed-memory window for privilege escalation, consistent with the CVSS score of 7.8 (high) with high confidentiality, integrity, and availability impact. Any Linux system running a kernel with kprobes enabled and the pre-fix code is affected; the exposed impact in practice depends on whether modules are unloaded at runtime. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Track stable and vendor kernel updates for the backported RCU-protected kprobes patch and deploy it as soon as your distribution ships it; no specific fixed version number is available yet. In the interim, restrict untrusted local shell access on production hosts and avoid unloading kernel modules on systems where unprivileged users may be running, since the race requires concurrent module unload and blacklist lookups. Verify whether CONFIG_KPROBES is enabled in your running kernel's configuration to gauge relevance.