CVE-2026-89610: Linux 0 to before 7.2.4, (exact versions not specified)

CVE-2026-89610 affects azl3 kernel 6.6.152.1-1 on Azure Linux 3.0. CVSS 3.1 base score 9.8 (CRITICAL, Source advisory). EPSS 0.00553 (percentile 0.45024), scored 17-Oct-2026.

Affected technology

Linux · 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e844d4b82434a781b80d02145fd1b17cf90e3c3, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fea9e4488f384c0ef1c0e3d96b565127c1b98447, 0 to before 7.2.4
Linux

Linux · Exact affected versions not specified by the source
Linux

Component: Not specified by the source
File: fs/ntfs/runlist.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could gain higher privileges under the conditions described by the source. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.

Published 19-Oct-2026 10:36 UTC

Product: azl3 kernel 6.6.152.1-1 on Azure Linux 3.0
CCR priority: 39.3 /100 (P4)
CVSS 3.1: 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · Source advisory
EPSS: 0.00553 · percentile 0.45024 · 2026-10-17
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-18 12:55:59.341568+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-19 10:33:46.008150+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-89610.html