vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-89169

MEDIUM
4.1
CVSS Score
Published: September 11, 2026 at 04:44 AM UTC
Updated: September 22, 2026 at 08:11 PM UTC
1 product affected across 1 vendorLive Boot

Using live-boot by Debian?

Get instant alerts when new vulnerabilities affect live-boot - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.1
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Live Boot· Debian
60%
ff8867c4e2d62e497cb895b15b7d6d518d5adff1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Source: cverecord
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146422
Source: cverecord
https://salsa.debian.org/live-team/live-boot/-/blob/ff8867c4e2d62e497cb895b15b7d6d518d5adff1/components/9990-overlay.sh#L112-114

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.1MEDIUMmitre
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-347

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card