CVE-2026-89992

CVE-2026-89992 is a memory-corruption flaw in the Linux kernel's cpuidle dt_idle_genpd code: dt_idle_pd_alloc() allocates the full device-tree node path with kasprintf() but points pd->name at the kbasename() inside that buffer, and dt_idle_pd_free() then calls kfree() on that interior pointer instead of the start of the allocation. The bug is triggered whenever a device-tree-based CPU idle power domain created through this helper is torn down (e.g., on domain removal or error paths) on ARM-class systems whose CPU idle states are managed via generic PM domains. Freeing a non-start-of-allocation pointer can corrupt slab state, giving a local attacker a route to kernel crashes (denial of service) and potentially privilege escalation, consistent with the CVSS 3.1 score of 8.4 (local vector, no privileges, high confidentiality/integrity/availability impact). Affected systems are Linux kernels containing the dt_idle_genpd code, which is used on various ARM SoC platforms such as Android and embedded devices rather than typical x86 servers. There is no evidence of exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Update affected devices with a kernel that includes the upstream patch 'cpuidle: dt_idle_genpd: kfree() the original name allocation' as it reaches your distro or SoC vendor's kernel branches. Until patched, limit untrusted local code execution on ARM devices using DT-based CPU idle power domains, since there is no known workaround and no active exploitation has been observed.