CVE-2026-89596

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An off-by-one error exists in the forcedeth driver when saving and restoring non-PCI configuration space. The functions nv suspend() and nv resume() use a loop that executes one iteration too many, leading to an out-of-bounds access of the saved config space array. This issue can cause the kernel to abort if CONFIG UBSAN TRAP is enabled. Additionally, it results in an unauthorized Memory-Mapped I/O (MMIO) read during suspension and an MMIO write during resume one dword past the mapped range of the driver base. This was observed on an Apple Macmini3,1 during a deep S3 sleep cycle.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.