CVE-2026-89556: module: validate string table section types
In the Linux kernel, the following vulnerability has been resolved:
module: validate string table section types
In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS.
Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHTSTRTAB. If a section type is SHTNULL or SHTNOBITS, shoffset has not been validated and may reference out-of-bounds memory when dereferenced in elfvaliditycachesecstrings or elfvaliditycachestrtab.
Validate that both string section headers are of type SHTSTRTAB before caching them.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The issue requires a malformed ELF module whose section-name table or symbol string-table header uses SHT_NULL or SHT_NOBITS instead of SHT_STRTAB. Those types can leave the section offset unvalidated before the kernel dereferences it.
What is the practical impact of the malformed module?
An unvalidated sh_offset for either affected string-table section may point outside the expected memory bounds when the kernel accesses the section-name table or symbol string table.
How can I determine whether a kernel includes the fix?
Check whether the kernel contains the change that validates both relevant string section headers as SHT_STRTAB before caching them. The supplied stable references identify commits 50d0aa7d25ba4bc3606f150cd69755068e79f97f, e4496dda2c6d0acf7ba5fbce14a2723a8935ceee, and 9a5ff45689329835f874cefe5174e577d141d423.