In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to
    kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct
    pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread
    creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop()
    then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before
    passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go
    unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing
    ERR_PTR to kthread_stop()"). (CVE-2026-89749)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and     unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error     pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the     boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel.
    Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to     create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit     91542863abad (ring-buffer: Fix crash passing ERR_PTR to kthread_stop()). (CVE-2026-89749)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
470471	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Cloud Security	Google COS Security Checks	Local	medium
470471	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345405	Linux Distros Unpatched Vulnerability : CVE-2026-89749	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89749

medium

Tenable Plugins

high

medium

medium

high

medium