Is CVE-2026-89169 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89169 being exploited in the wild.

How severe is CVE-2026-89169?

Informational severity, with a CVSS score of 6.2, published 11 September 2026.

Which products and versions are affected?

Debian Live-Boot 1:20220505 through at least 1:20230131+deb12u1.

Is there a fix for CVE-2026-89169?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89169 attacked?

It is attacked from the adjacent network or with physical access, in an operating system.

Am I affected by CVE-2026-89169?

Check whether you run Debian Live-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89169: Debian live-boot dm-verity bypass when .verity file missing

CVE-2026-89169 · Severity: info · CVSS 6.2 · Published 2026-09-11

Debian live-boot is a system used to boot and manage live Linux systems from removable media. When the optional .verity file is deleted from the boot medium, the system ignores all dm-verity integrity protection settings configured via kernel parameters, allowing an attacker to modify the filesystem without detection. This can defeat security protections like signed root hash verification even in Secure Boot environments.

Vendors: Debian.

Quick answers

Is CVE-2026-89169 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89169 being exploited in the wild.
How severe is CVE-2026-89169?: Informational severity, with a CVSS score of 6.2, published 11 September 2026.
Which products and versions are affected?: Debian Live-Boot 1:20220505 through at least 1:20230131+deb12u1.
Is there a fix for CVE-2026-89169?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89169 attacked?: It is attacked from the adjacent network or with physical access, in an operating system.
Am I affected by CVE-2026-89169?: Check whether you run Debian Live-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logic error in live-boot's dm-verity initialization code. The initramfs parses dm-verity kernel command-line parameters (dm-verity-enforce-roothash-signature, dm-verity-oncorruption, dm-verity-root-hash) during boot, but only applies them if a .verity file exists on the filesystem. An attacker with access to the block device can delete the .verity file, causing the system to boot without dm-verity protection regardless of kernel parameters. The dm_verity kernel module is never loaded when no .verity file is present, bypassing even kernel-level signature enforcement. This affects all live-boot versions from 1:20220505 onwards. The fix requires live-boot to validate dm-verity file presence or hash consistency regardless of .verity file existence, or to fail safely when dm-verity parameters are set but cannot be enforced.

Affected products

Debian live-boot 1:20220505 through at least 1:20230131+deb12u1

Timeline

2026-09-01: disclosed: Bug reported to Debian Bug Tracking System
2026-09-11: advisory: CVE-2026-89169 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.