CVE-2026-89988

A flaw was found in the kprobes component of the Linux kernel. A local attacker could potentially exploit a use-after-free vulnerability when a module is unloaded concurrently with a call to __within_kprobe_blacklist(). This could lead to dereferencing freed memory, potentially causing system instability or a denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is confined to local environments and requires precise timing during module removal operations, limiting the blast radius primarily to a kernel crash. Under default system configurations, unloading kernel modules is an administrative action that is rarely executed in normal operational workflows. As a result, an attacker requires specific local conditions and synchronization to trigger memory corruption, reducing the practical risk of widespread exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.