CVE-2026-93196 (GCVE-0-2026-93196)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:12 – Updated: 2026-09-18 17:56
VLAI
Title
nvdimm: virtio_pmem: refcount requests for token lifetime
Summary
In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtio_pmem: refcount requests for token lifetime KASAN reports slab-use-after-free in __wake_up_common(): BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x6d/0xb0 print_report+0x170/0x4e2 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __virt_addr_valid+0x1dc/0x380 kasan_report+0xbc/0xf0 ? __wake_up_common+0x114/0x160 ? __wake_up_common+0x114/0x160 __wake_up_common+0x114/0x160 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 __wake_up+0x36/0x60 virtio_pmem_host_ack+0x11d/0x3b0 ? sched_balance_domains+0x29f/0xb00 ? __pfx_virtio_pmem_host_ack+0x10/0x10 ? _raw_spin_lock_irqsave+0x98/0x100 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 vring_interrupt+0x1c9/0x5e0 ? __pfx_vp_interrupt+0x10/0x10 vp_vring_interrupt+0x87/0x100 ? __pfx_vp_interrupt+0x10/0x10 __handle_irq_event_percpu+0x17f/0x550 ? __pfx__raw_spin_lock+0x10/0x10 handle_irq_event+0xab/0x1c0 handle_fasteoi_irq+0x276/0xae0 __common_interrupt+0x65/0x130 common_interrupt+0x78/0xa0 </IRQ> virtio_pmem_host_ack() wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtio_pmem_flush() returns and frees it. Fix the token lifetime by refcounting struct virtio_pmem_request. virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6e84200c0a2994b991259d19450eee561029bf70 , < be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491 (git)
Affected: 6e84200c0a2994b991259d19450eee561029bf70 , < b1e740b9156621afd4c4aa66257f4dde8df1febe (git)
Affected: 6e84200c0a2994b991259d19450eee561029bf70 , < e57140944b5a47a7fd5a142faab29a02af040bc8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/nd_virtio.c",
            "drivers/nvdimm/virtio_pmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491",
              "status": "affected",
              "version": "6e84200c0a2994b991259d19450eee561029bf70",
              "versionType": "git"
            },
            {
              "lessThan": "b1e740b9156621afd4c4aa66257f4dde8df1febe",
              "status": "affected",
              "version": "6e84200c0a2994b991259d19450eee561029bf70",
              "versionType": "git"
            },
            {
              "lessThan": "e57140944b5a47a7fd5a142faab29a02af040bc8",
              "status": "affected",
              "version": "6e84200c0a2994b991259d19450eee561029bf70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/nd_virtio.c",
            "drivers/nvdimm/virtio_pmem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: virtio_pmem: refcount requests for token lifetime\n\nKASAN reports slab-use-after-free in __wake_up_common():\nBUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160\nRead of size 8 at addr ffff88810fdcb710 by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted\n6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux\n1.17.0-2-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x6d/0xb0\n print_report+0x170/0x4e2\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __virt_addr_valid+0x1dc/0x380\n kasan_report+0xbc/0xf0\n ? __wake_up_common+0x114/0x160\n ? __wake_up_common+0x114/0x160\n __wake_up_common+0x114/0x160\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n __wake_up+0x36/0x60\n virtio_pmem_host_ack+0x11d/0x3b0\n ? sched_balance_domains+0x29f/0xb00\n ? __pfx_virtio_pmem_host_ack+0x10/0x10\n ? _raw_spin_lock_irqsave+0x98/0x100\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n vring_interrupt+0x1c9/0x5e0\n ? __pfx_vp_interrupt+0x10/0x10\n vp_vring_interrupt+0x87/0x100\n ? __pfx_vp_interrupt+0x10/0x10\n __handle_irq_event_percpu+0x17f/0x550\n ? __pfx__raw_spin_lock+0x10/0x10\n handle_irq_event+0xab/0x1c0\n handle_fasteoi_irq+0x276/0xae0\n __common_interrupt+0x65/0x130\n common_interrupt+0x78/0xa0\n \u003c/IRQ\u003e\n\nvirtio_pmem_host_ack() wakes a request that has already been freed by the\nsubmitter.\n\nThis happens when the request token is still reachable via the virtqueue,\nbut virtio_pmem_flush() returns and frees it.\n\nFix the token lifetime by refcounting struct virtio_pmem_request.\nvirtio_pmem_flush() holds a submitter reference, and the virtqueue holds an\nextra reference once the request is queued. The completion path drops the\nvirtqueue reference, and the submitter drops its reference before\nreturning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - virtio_pmem_host_ack() is the flush_queue callback registered in init_vq() and invoked from vring_interrupt() when the virtio-pmem backend completes a token; pmem_submit_bio() (REQ_PREFLUSH/REQ_FUA) and nd_pmem_remove() reach virtio_pmem_flush() only on that paravirtual device, not via a routable protocol message.\nAC:L - virtio_pmem_flush() kfree()s req_data after virtqueue_kick() fails while the token remains in req_vq, and on the success path kfree()s it while virtio_pmem_host_ack() still runs wake_up(\u0026req_data-\u003ehost_acked); a backend writing the used ring, or concurrent PREFLUSH/FUA bios (flush_lock only exists after a9ba6733), drives that lifetime hole.\nPR:N - virtio_pmem_host_ack() authenticates nothing and holds no guest credential. Host-initiated unplug runs virtio_pmem_remove()\u2192nvdimm_bus_unregister()\u2192nd_pmem_remove(), which calls nvdimm_flush(nd_region, NULL)\u2192virtio_pmem_flush() with no capable() check before the token is queued on req_vq.\nUI:N - nd_pmem_remove()/nd_pmem_shutdown() submit virtio_pmem_flush() during teardown the backend/VMM initiates, and virtio_pmem_host_ack() then runs from vring_interrupt with no guest ioctl, mount, or file open; a local user of /dev/pmem likewise issues their own PREFLUSH/FUA bios.\nS:U - The freed object is a guest kmalloc struct virtio_pmem_request used only inside virtio_pmem_flush() and virtio_pmem_host_ack(); corruption stays in that guest kernel and is not a KVM/Xen guest-to-host escape or IOMMU/DMA bypass.\nC:H - virtio_pmem_host_ack() takes the freed token from virtqueue_get_buf() and writes req_data-\u003edone then wake_up(\u0026req_data-\u003ehost_acked) on the kfree\u0027d slab; reuse of that virtio_pmem_request is a use-after-free read primitive once the object is sprayed.\nI:H - KASAN reports slab-use-after-free in __wake_up_common() from virtio_pmem_host_ack(): wake_up() walks the freed host_acked wait_queue_head, so a sprayed wait_queue_entry.func yields an indirect call and list-pointer write.\nA:H - KASAN reports slab-use-after-free in __wake_up_common() from virtio_pmem_host_ack() in vring_interrupt IRQ context on swapper/0, which oopses or panics the guest even when the UAF is not turned into a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:30.264Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1e740b9156621afd4c4aa66257f4dde8df1febe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e57140944b5a47a7fd5a142faab29a02af040bc8"
        }
      ],
      "title": "nvdimm: virtio_pmem: refcount requests for token lifetime",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93196",
    "datePublished": "2026-09-17T16:12:19.125Z",
    "dateReserved": "2026-09-17T16:02:15.092Z",
    "dateUpdated": "2026-09-18T17:56:30.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93196",
      "date": "2026-09-25",
      "epss": "0.00188",
      "percentile": "0.07491"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvdimm/nd_virtio.c",
                  "drivers/nvdimm/virtio_pmem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491",
                    "status": "affected",
                    "version": "6e84200c0a2994b991259d19450eee561029bf70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b1e740b9156621afd4c4aa66257f4dde8df1febe",
                    "status": "affected",
                    "version": "6e84200c0a2994b991259d19450eee561029bf70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e57140944b5a47a7fd5a142faab29a02af040bc8",
                    "status": "affected",
                    "version": "6e84200c0a2994b991259d19450eee561029bf70",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvdimm/nd_virtio.c",
                  "drivers/nvdimm/virtio_pmem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: virtio_pmem: refcount requests for token lifetime\n\nKASAN reports slab-use-after-free in __wake_up_common():\nBUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160\nRead of size 8 at addr ffff88810fdcb710 by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted\n6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux\n1.17.0-2-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x6d/0xb0\n print_report+0x170/0x4e2\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __virt_addr_valid+0x1dc/0x380\n kasan_report+0xbc/0xf0\n ? __wake_up_common+0x114/0x160\n ? __wake_up_common+0x114/0x160\n __wake_up_common+0x114/0x160\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n __wake_up+0x36/0x60\n virtio_pmem_host_ack+0x11d/0x3b0\n ? sched_balance_domains+0x29f/0xb00\n ? __pfx_virtio_pmem_host_ack+0x10/0x10\n ? _raw_spin_lock_irqsave+0x98/0x100\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n vring_interrupt+0x1c9/0x5e0\n ? __pfx_vp_interrupt+0x10/0x10\n vp_vring_interrupt+0x87/0x100\n ? __pfx_vp_interrupt+0x10/0x10\n __handle_irq_event_percpu+0x17f/0x550\n ? __pfx__raw_spin_lock+0x10/0x10\n handle_irq_event+0xab/0x1c0\n handle_fasteoi_irq+0x276/0xae0\n __common_interrupt+0x65/0x130\n common_interrupt+0x78/0xa0\n \u003c/IRQ\u003e\n\nvirtio_pmem_host_ack() wakes a request that has already been freed by the\nsubmitter.\n\nThis happens when the request token is still reachable via the virtqueue,\nbut virtio_pmem_flush() returns and frees it.\n\nFix the token lifetime by refcounting struct virtio_pmem_request.\nvirtio_pmem_flush() holds a submitter reference, and the virtqueue holds an\nextra reference once the request is queued. The completion path drops the\nvirtqueue reference, and the submitter drops its reference before\nreturning."
          }
        ],
        "id": "CVE-2026-93196",
        "lastModified": "2026-09-18T18:18:24.743",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:15.880",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b1e740b9156621afd4c4aa66257f4dde8df1febe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e57140944b5a47a7fd5a142faab29a02af040bc8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.