UBUNTU-CVE-2026-89556: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHTSTRTAB. If a section type is SHTNULL or SHTNOBITS, shoffset has not been validated and may reference out-of-bounds memory when dereferenced in elfvaliditycachesecstrings or elfvaliditycachestrtab. Validate that both string section headers are of type SHTSTRTAB before caching them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition is needed to trigger the vulnerable code path?
The kernel must process an ELF module whose section-name string table or symbol string table header has type SHT_NULL or SHT_NOBITS. In that case, its offset may not have been validated before later code dereferences it.
How can a module be checked for the malformed condition described?
Inspect the ELF section headers for the section-name string table and symbol string table. Both should have the SHT_STRTAB type; SHT_NULL or SHT_NOBITS in either relevant string-table header matches the invalid condition addressed by the fix.