{"id":"CVE-2026-93196","aliases":[],"cve":{"records":[{"id":"CVE-2026-93196","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T16:02:15.092Z","published":"2026-09-17T16:12:19.125Z","modified":"2026-10-30T12:36:20.592Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:36:20.592Z"}],"references":[{"url":"https://git.kernel.org/stable/c/71ac70fc7f95963eca9d1145a9b02b8fe149eb4f","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/41b2025709ec104a07d15540399809ae5851246e","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/4691c137e9cbe76137d730a26d663d900ac7279b","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b1e740b9156621afd4c4aa66257f4dde8df1febe","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/e57140944b5a47a7fd5a142faab29a02af040bc8","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"nvdimm: virtio_pmem: refcount requests for token lifetime","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: virtio_pmem: refcount requests for token lifetime\n\nKASAN reports slab-use-after-free in __wake_up_common():\nBUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160\nRead of size 8 at addr ffff88810fdcb710 by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted\n6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux\n1.17.0-2-2 04/01/2014\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x6d/0xb0\n print_report+0x170/0x4e2\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __virt_addr_valid+0x1dc/0x380\n kasan_report+0xbc/0xf0\n ? __wake_up_common+0x114/0x160\n ? __wake_up_common+0x114/0x160\n __wake_up_common+0x114/0x160\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n __wake_up+0x36/0x60\n virtio_pmem_host_ack+0x11d/0x3b0\n ? sched_balance_domains+0x29f/0xb00\n ? __pfx_virtio_pmem_host_ack+0x10/0x10\n ? _raw_spin_lock_irqsave+0x98/0x100\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n vring_interrupt+0x1c9/0x5e0\n ? __pfx_vp_interrupt+0x10/0x10\n vp_vring_interrupt+0x87/0x100\n ? __pfx_vp_interrupt+0x10/0x10\n __handle_irq_event_percpu+0x17f/0x550\n ? __pfx__raw_spin_lock+0x10/0x10\n handle_irq_event+0xab/0x1c0\n handle_fasteoi_irq+0x276/0xae0\n __common_interrupt+0x65/0x130\n common_interrupt+0x78/0xa0\n </IRQ>\n\nvirtio_pmem_host_ack() wakes a request that has already been freed by the\nsubmitter.\n\nThis happens when the request token is still reachable via the virtqueue,\nbut virtio_pmem_flush() returns and frees it.\n\nFix the token lifetime by refcounting struct virtio_pmem_request.\nvirtio_pmem_flush() holds a submitter reference, and the virtqueue holds an\nextra reference once the request is queued. The completion path drops the\nvirtqueue reference, and the submitter drops its reference before\nreturning.","score":8.4,"severity":"high","published":"2026-09-17T16:12:19.125Z","modified":"2026-10-30T12:36:20.592Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"71ac70fc7f95963eca9d1145a9b02b8fe149eb4f","versionType":"git"},{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"41b2025709ec104a07d15540399809ae5851246e","versionType":"git"},{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"4691c137e9cbe76137d730a26d663d900ac7279b","versionType":"git"},{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491","versionType":"git"},{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"b1e740b9156621afd4c4aa66257f4dde8df1febe","versionType":"git"},{"version":"6e84200c0a2994b991259d19450eee561029bf70","status":"affected","lessThan":"e57140944b5a47a7fd5a142faab29a02af040bc8","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93196"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93196"}],"remediation":[],"references":["https://git.kernel.org/stable/c/71ac70fc7f95963eca9d1145a9b02b8fe149eb4f","https://git.kernel.org/stable/c/41b2025709ec104a07d15540399809ae5851246e","https://git.kernel.org/stable/c/4691c137e9cbe76137d730a26d663d900ac7279b","https://git.kernel.org/stable/c/be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491","https://git.kernel.org/stable/c/b1e740b9156621afd4c4aa66257f4dde8df1febe","https://git.kernel.org/stable/c/e57140944b5a47a7fd5a142faab29a02af040bc8"],"sources":[{"name":"CVE","id":"CVE-2026-93196","modified":"2026-10-30T12:36:20.592Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93196"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4}],"sourceAffected":[],"observedAt":"2026-10-30T13:55:31.266Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:25:33.720Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}