CVE-2026-89989

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the

buffer. validate_hash_algo() passes the result straight to

integrity_audit_msg() without checking. ERR_PTR is not NULL, so

integrity_audit_message() sees a valid pointer and calls strlen() on

it, which faults:

BUG: unable to handle page fault for address: ffffffffffffffdc

RIP: 0010:strlen+0x30/0xa0

Call Trace:

audit_log_untrustedstring+0x19/0x30

integrity_audit_message+0x366/0x4f0

ima_inode_setxattr+0x512/0x5f0

Check for IS_ERR() and use NULL instead, which makes the audit message

skip the name= field instead of crashing.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References