CVE-2026-89992 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
cpuidle: dt_idle_genpd: kfree() the original name allocation
dt_idle_pd_alloc() kasprintf()s the full node path, then points pd->name at kbasename() of that string. dt_idle_pd_free() kfree()s pd->name, which is no longer the start of the allocation.
Copy the basename instead.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The identified vulnerability resides within the Linux kernel's CPU idle subsystem, specifically in the device tree-based generic power domain driver responsible for managing processor idle states. This issue manifests as a memory corruption defect stemming from improper handling of dynamically allocated strings during the initialization and cleanup phases of power domain objects. The root cause lies in the interaction between string allocation functions and pointer arithmetic operations that do not preserve the original base address required for safe deallocation.
During the setup process, the function dt_idle_pd_alloc utilizes kasprintf to allocate a buffer containing the full node path from the device tree. Subsequently, the code assigns pd->name by pointing it directly at the result of kbasename applied to this allocated string. The kbasename utility is designed to return a pointer to the last component of a pathname, effectively skipping over any preceding directory components. While this approach correctly identifies the relevant name for identification purposes, it fundamentally alters the memory address stored in pd->name so that it no longer points to the beginning of the heap allocation created by kasprintf.
The critical failure occurs during the cleanup phase when dt_idle_pd_free is invoked to release resources associated with the power domain object. This function attempts to free the memory referenced by pd->name using kfree. Because pd->name was modified to point into the middle of the original buffer rather than its start, passing this pointer to kfree violates the C standard and kernel memory management requirements. Passing a non-aligned or offset pointer to kfree results in undefined behavior, which typically leads to heap corruption, potential system crashes, or exploitable conditions where an attacker might manipulate memory structures for privilege escalation or denial of service attacks.
This flaw is categorized under CWE-415, Double Free, although it more accurately aligns with CWE-789, Uncontrolled Memory Allocation, and specifically the misuse of free functions on invalid pointers. In terms of attack vectors, this vulnerability could be leveraged in scenarios where an attacker has control over device tree parameters or can trigger repeated allocation and deallocation cycles to destabilize kernel memory pools. The ATT&CK framework would classify this under techniques related to resource manipulation that lead to system instability, potentially facilitating further exploitation if combined with other vulnerabilities such as use-after-free conditions resulting from the corrupted heap metadata.
The operational impact of this vulnerability includes potential kernel panics due to invalid free operations, which disrupts service availability and compromises system integrity. In worst-case scenarios involving sophisticated memory corruption techniques, it could allow for arbitrary code execution by exploiting the altered state of the slab allocator or buddy system within the Linux kernel. The severity is heightened because CPU idle management functions are often executed during boot sequences or frequent power state transitions, increasing the attack surface exposure window.
To mitigate this vulnerability, developers must ensure that any pointer passed to kfree corresponds exactly to the address returned by the corresponding allocation function such as kasprintf, kmalloc, or kzalloc. The recommended fix involves copying the basename string into a newly allocated buffer rather than merely pointing pd->name at an offset within the existing allocation. This ensures that pd->name holds a valid base pointer for its own dedicated memory block, allowing dt_idle_pd_free to safely release it without corrupting adjacent heap structures or violating kernel memory management protocols. Maintaining strict separation between string content extraction and memory ownership is essential for preventing such class of defects in low-level system software.