CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved:

lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen()

Patch series "lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen()", v2.

This series fixes an off-by-one out-of-bounds read in ucs2 strnlen().

The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation.

This patch (of 2):

ucs2 strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2 char t past the limit.

Test the length before dereferencing to prevent an off-by-one out-of-bounds read.