{ "cveId": "CVE-2026-89600", "url": "https://patchblox.com/security/cve/CVE-2026-89600", "summary": "CVE-2026-89600 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-89600, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info...", "description": "In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotify_pre_content() builds its file_range on the triggering task\u0027s stack. fanotify_alloc_perm_event() saves a pointer to range.pos in the heap-allocated permission event so copy_range_info_to_user() can report the offset later. The event reader can set the event state to FAN_EVENT_REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and returns. This unwinds the file_range stack frame while the reader still owns the event. The reader then dereferences pevent-\u003Eppos and copies the stale stack value to userspace. KASAN reported: BUG: KASAN: use-after-free in fanotify_read\u002B0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task fanotify_inotif/95 Call Trace: fanotify_read\u002B0x293e/0x2970 vfs_read\u002B0x177/0xa20 ksys_read\u002B0xf7/0x1c0 do_syscall_64\u002B0xf9/0x540 entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f Store the range position directly in the permission event and use FANOTIFY_NO_RANGE when range information is unavailable. The event remains alive until the reader finishes, so the reported offset no longer depends on the triggering task\u0027s stack.", "published": "2026-09-11T20:19:44Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00124, "epssPercentile": 0.02124, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.51-120.162", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.6-1", "fix": "DEBIAN-CVE-2026-89600", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89600", "released": "2026-09-23T19:19:02Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.51-120.162.amzn2023", "fix": "ALAS2023-2026-3187", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3187", "released": "2026-11-07T01:06:52Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T00:53:09Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }