https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 20:07:47 +0000 https://db.gcve.eu/vuln/cve-2026-93073 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dax: read holder_ops once in dax_holder_notify_failure()</p> <p>dax_holder_notify_failure() reads dax_dev-&gt;holder_ops twice without READ_ONCE() -- once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (kill_dax() also clears holder_ops, but only after synchronize_srcu(), so it cannot race a reader that is inside dax_read_lock(); fs_put_dax() does no such synchronization.)</p> <p>Fetch holder_ops once into a local with READ_ONCE() so the NULL check and the indirect call observe the same value.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dax: read holder_ops once in dax_holder_notify_failure()</p> <p>dax_holder_notify_failure() reads dax_dev-&gt;holder_ops twice without READ_ONCE() -- once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (kill_dax() also clears holder_ops, but only after synchronize_srcu(), so it cannot race a reader that is inside dax_read_lock(); fs_put_dax() does no such synchronization.)</p> <p>Fetch holder_ops once into a local with READ_ONCE() so the NULL check and the indirect call observe the same value.</p> https://db.gcve.eu/vuln/cve-2026-93073