Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-93208

kasan: fix cache shrink race with CPU hotplug

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:25:33 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Attack conditions

for_each_possible_cpu() can do more work than for_each_online_cpu(), but this change only affects CONFIG_KASAN_GENERIC kernels.

Excerpt from the original source description below.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

6 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before eab61c0781cbe899e074c0009af304f3b337e0c9

git versions

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before 7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a

git versions

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before 709c3646545e0a1f99a5816384c633f6552c5a98

git versions

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before 30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3

git versions

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before 3119d58e4ef8719d669911d38a53fc00086ac48b

git versions

07d067e4f2ceb72b9f681995cc53828caaba9e6e → before 8790303cbaac52a11dfed4aab261f8ea60682525

git versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

8 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.19

unaffected

0 → before 5.19

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.157 → through 6.6.*

semver versions

6.12.109 → through 6.12.*

semver versions

6.18.50 → through 6.18.*

semver versions

7.2.4 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

kasan: fix cache shrink race with CPU hotplug

kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on all online CPUs. Each callback moves objects belonging to the cache from cpu_quarantine to the CPU's shrink_qlist, where they can later be freed from task context.

kmem_cache_destroy() invokes the quarantine removal path while holding cpus_read_lock(), but kmem_cache_shrink() does not. The latter can therefore race with CPU offlining as follows:

kmem_cache_shrink() CPU hotplug

on_each_cpu() CPU1 moves objects to CPU1's shrink_qlist on_each_cpu() returns CPU1 goes offline kasan_cpu_offline() drains cpu_quarantine leaves shrink_qlist untouched for_each_online_cpu() skips CPU1

The objects left on CPU1's shrink_qlist are not returned to the slab allocator. This may prevent kmem_cache_shrink() from releasing slabs that would otherwise become empty. If CPU1 remains offline, a later kmem_cache_destroy() also skips the list and can report that the cache still contains objects.

An intermittent occurrence was observed with a virtio-9p filesystem. The mount and umount commands both returned 0, but the kernel logged the following during the userspace-triggered teardown:

[ 2994.380134][ T111] BUG 9p-fcall-cache-1 (Tainted: G B ): Objects remaining on __kmem_cache_shutdown() [ 2994.381140][ T111] Object 0xff11000004361118 @offset=4376 [ 2994.381607][ T111] Allocated in p9_fcall_init+0x201/0x400 age=19564 cpu=1 pid=104 [ 2994.382591][ T111] p9_fcall_init+0x201/0x400 [ 2994.382810][ T111] p9_tag_alloc+0x12f/0x700 [ 2994.382982][ T111] p9_client_prepare_req+0x102/0x3e0 [ 2994.383165][ T111] p9_client_rpc+0x1ab/0xa50 [ 2994.383334][ T111] p9_client_getattr_dotl+0xb0/0x1a0 [ 2994.383515][ T111] v9fs_vfs_getattr_dotl+0x115/0x360 [ 2994.383719][ T111] vfs_getattr_nosec+0x22c/0x3a0 [ 2994.383910][ T111] vfs_statx+0xd7/0x170 [ 2994.384062][ T111] vfs_fstatat+0x45/0x80 [ 2994.384215][ T111] __do_sys_newfstatat+0x84/0xe0 [ 2994.384386][ T111] do_syscall_64+0x115/0x6a0 [ 2994.384566][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2994.399720][ T111] WARNING: mm/slub.c:1244 at __kmem_cache_shutdown+0x363/0x500, CPU#0: busybox/111 [ 2994.405655][ T111] Call Trace: [ 2994.406325][ T111] kmem_cache_destroy+0x73/0x1b0 [ 2994.406630][ T111] p9_client_destroy+0x271/0x3c0 [ 2994.407210][ T111] v9fs_session_close+0x3c/0x260 [ 2994.407409][ T111] v9fs_kill_super+0x48/0x90 [ 2994.407584][ T111] deactivate_locked_super+0xa3/0x160 [ 2994.407778][ T111] cleanup_mnt+0x1dd/0x3e0

Thus, a successful umount left objects in the 9p fcall cache and prevented the cache from being destroyed cleanly.

Per-CPU shrink_qlist storage exists for every possible CPU, and each list is protected by its own raw spinlock. Iterate over possible CPUs so that a list populated before its CPU went offline is drained as well.

for_each_possible_cpu() can do more work than for_each_online_cpu(), but this change only affects CONFIG_KASAN_GENERIC kernels. The extra work is limited to cache shrink and cache destruction paths and does not affect the normal allocation/free fast path. It adds one raw-spinlock-protected scan of each possible CPU's shrink list. These lists are normally empty; a non-empty list is traversed to remove objects belonging to the cache being shrunk or destroyed.

References

6 sources
git.kernel.org/stable/c/eab61c0781cbe899e074c0009af304f3b337e0c9
Source referenceLinux
git.kernel.org/stable/c/7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a
Source referenceLinux
git.kernel.org/stable/c/709c3646545e0a1f99a5816384c633f6552c5a98
Source referenceLinux
git.kernel.org/stable/c/30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3
Source referenceLinux
git.kernel.org/stable/c/3119d58e4ef8719d669911d38a53fc00086ac48b
Source referenceLinux
git.kernel.org/stable/c/8790303cbaac52a11dfed4aab261f8ea60682525
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-93208

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.6.157

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.12.109

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.18.50

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 7.2.4

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 7.3

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.6.157"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.12.109"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.18.50"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "7.2.4"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "7.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-10-30

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.