In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the guaranteed minimum size across the pool.

An update of the linux package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global
    buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a
    resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same
    size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is
    treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than
    gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy
    the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the
    guaranteed minimum size across the pool. (CVE-2026-89602)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global     buffers when resizing z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a     resize fails after some buffers were enlarged, a retry revisits those enlarged buffers. Retrying the same     size then returns -ENOMEM because alloc_pages_bulk() has no pages to add and the unchanged return value is     treated as a failure. Retrying an intermediate size allocates a temporary pointer array smaller than     gbuf->nrpages and copies more existing pointers than the array can hold. Skip buffers that already satisfy     the request. Once all remaining buffers have caught up, advancing z_erofs_gbuf_nrpages again describes the     guaranteed minimum size across the pool. (CVE-2026-89602)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
381201	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22266-1)	Nessus	SuSE Local Security Checks	Local	high
381194	openSUSE 16: cluster-md-kmp-nvidia64kb / dlm-kmp-nvidia64kb / etc (openSUSE-SU-2026:22307-1)	Nessus	SuSE Local Security Checks	Local	high
379497	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24651-1)	Nessus	SuSE Local Security Checks	Local	high
379474	SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24662-1)	Nessus	SuSE Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
375113	Photon OS 5.0: Linux PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	Local	high
375014	Photon OS 5.0: Linux PHSA-2026-5.0-92-1014	Nessus	PhotonOS Local Security Checks	Local	high
475322	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	high
475322	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345189	Linux Distros Unpatched Vulnerability : CVE-2026-89602	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89602

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

medium

high

high

high

high