CVE-2026-89552

A flaw was found in the Linux kernel. When updating charp parameters, an allocation failure can cause the parameter to be set to NULL before the new value is successfully allocated. This can lead to a kernel NULL pointer dereference, which may result in a system crash and a denial of service.

A flaw in the Linux kernel's handling of charp (string) module parameters affects the kernel and kernel-rt packages in Red Hat Enterprise Linux and the RHEL CoreOS kernels shipped in OpenShift Container Platform, and is rated by Red Hat as Low impact. When a charp parameter such as zswap's compressor setting is updated, param_set_charp() releases the previous value before the replacement allocation is attempted; if that allocation fails, the setter returns -ENOMEM and leaves the parameter set to NULL. A later use of the NULL parameter, for example strcmp() during zswap_setup(), causes a kernel NULL pointer dereference and kernel panic, resulting in a denial of service. Exploiting this flaw requires local access with privileges sufficient to write kernel module parameters via sysfs, and additionally depends on a memory allocation failing at the time of the parameter update, so the consequence is limited to availability. Red Hat scores this flaw CVSS:3.1 5.5 (MODERATE, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) while rating the overall impact as Low for these reasons. Fixes for the affected Red Hat Enterprise Linux and OpenShift Container Platform streams are currently deferred because the flaw falls below the severity threshold at which fixes are prioritized; the residual risk is that a privileged local user could crash the system when updating affected kernel parameters under memory-pressure conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.