---
title: "CVE-2026-89557: Linux Kernel - Integer Overflow"
description: "Linux kernel contains an integer overflow caused by lack of overflow check on sb->bblog_shift in super_1_load(), letting attackers trigger overflow in badblocks_set() via crafted superblock, exploit requires crafted on-disk superblock."
url: https://panop.io/threat-heartbeat/CVE-2026-89557/
---

# CVE-2026-89557 Linux Kernel - Integer Overflow

Linux kernel contains an integer overflow caused by lack of overflow check on sb->bblog\_shift in super\_1\_load(), letting attackers trigger overflow in badblocks\_set() via crafted superblock, exploit requires crafted on-disk superblock.

CVSS base score 7.8 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.17% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89557)

## Details

Type

Integer Overflow

Impact

Denial Of Service

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version with the overflow check in super\_1\_load()

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89557](https://nvd.nist.gov/vuln/detail/CVE-2026-89557)
- [https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8](https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8)
- [https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f](https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f)
- [https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396](https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396)
- [https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6](https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6)
- [https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93](https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93)
- [https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f](https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f)
- [https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0](https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0)
- [https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f](https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)