---
id: CVE-2026-89726
title: 'lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

  Patch series "lib/ucs2_string.c: fix out-of-bounds read in
  ucs2_strnlen()", v2.

  This series fixes an off-b…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    04ae68af4107600120c3c41c94268f43bc350d48
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2e5a70a175f0c74e7238b013a96c4eabc3002934
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3ada20e110bf3245edb0a3bcddadc33d0f142f8d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    60c74f42f5abddb85dd919b4448d5474e65dbe76
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    709eb41adaf78d59d4579a13a898125919b69bcc
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    7d658da725ea81c91f73087547b97e7ced82d62b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    1b0dc3cbb8630f0b5cb34d848628225920a904be
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cec0d03fe785380540dc1b4d07c80f67ae2ffc78
  - Linux 2.6.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:39.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89726'
references:
  - url: 'https://git.kernel.org/stable/c/04ae68af4107600120c3c41c94268f43bc350d48'
  - url: 'https://git.kernel.org/stable/c/2e5a70a175f0c74e7238b013a96c4eabc3002934'
  - url: 'https://git.kernel.org/stable/c/3ada20e110bf3245edb0a3bcddadc33d0f142f8d'
  - url: 'https://git.kernel.org/stable/c/60c74f42f5abddb85dd919b4448d5474e65dbe76'
  - url: 'https://git.kernel.org/stable/c/709eb41adaf78d59d4579a13a898125919b69bcc'
  - url: 'https://git.kernel.org/stable/c/7d658da725ea81c91f73087547b97e7ced82d62b'
  - url: 'https://git.kernel.org/stable/c/1b0dc3cbb8630f0b5cb34d848628225920a904be'
  - url: 'https://git.kernel.org/stable/c/cec0d03fe785380540dc1b4d07c80f67ae2ffc78'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89726'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532261'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89726'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89726'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89726.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00177
epssPercentile: 0.07238
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Patch series "lib/ucs2_string.c: fix out-of-bounds read in
ucs2_strnlen()", v2.

This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().

The first patch is the real fix, the second patch comes as a bonus and
fixes the code indentation.


This patch (of 2):

ucs2_strnlen() checks the current character before checking whether the
caller-provided maximum length has been reached.  If the input is not
NUL-terminated within that bound, the loop can read one ucs2_char_t past
the limit.

Test the length before dereferencing to prevent an off-by-one
out-of-bounds read.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 04ae68af4107600120c3c41c94268f43bc350d48`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2e5a70a175f0c74e7238b013a96c4eabc3002934`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3ada20e110bf3245edb0a3bcddadc33d0f142f8d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 60c74f42f5abddb85dd919b4448d5474e65dbe76`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 709eb41adaf78d59d4579a13a898125919b69bcc`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7d658da725ea81c91f73087547b97e7ced82d62b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1b0dc3cbb8630f0b5cb34d848628225920a904be`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cec0d03fe785380540dc1b4d07c80f67ae2ffc78`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89726.json)