Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by Linux

CVE-2026-93196nvdimm: virtio_pmem: refcount requests for token lifetime

High 8.4

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 93.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtio_pmem: refcount requests for token lifetime KASAN reports slab-use-after-free in __wake_up_common(): BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x6d/0xb0 print_report+0x170/0x4e2 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __virt_addr_valid+0x1dc/0x380 kasan_report+0xbc/0xf0 ? __wake_up_common+0x114/0x160 ? __wake_up_common+0x114/0x160 __wake_up_common+0x114/0x160 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 __wake_up+0x36/0x60 virtio_pmem_host_ack+0x11d/0x3b0 ? sched_balance_domains+0x29f/0xb00 ? __pfx_virtio_pmem_host_ack+0x10/0x10 ? _raw_spin_lock_irqsave+0x98/0x100 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 vring_interrupt+0x1c9/0x5e0 ? __pfx_vp_interrupt+0x10/0x10 vp_vring_interrupt+0x87/0x100 ? __pfx_vp_interrupt+0x10/0x10 __handle_irq_event_percpu+0x17f/0x550 ? __pfx__raw_spin_lock+0x10/0x10 handle_irq_event+0xab/0x1c0 handle_fasteoi_irq+0x276/0xae0 __common_interrupt+0x65/0x130 common_interrupt+0x78/0xa0 </IRQ> virtio_pmem_host_ack() wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtio_pmem_flush() returns and frees it. Fix the token lifetime by refcounting struct virtio_pmem_request. virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linuxno fix listedDEBIAN-CVE-2026-93196
Debian:13linux6.12.113-1DEBIAN-CVE-2026-93196
Debian:14linux7.2.6-1DEBIAN-CVE-2026-93196
Debian:12linux-6.126.12.113-1~deb12u1DEBIAN-CVE-2026-93196
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-93196
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-93196
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-93196
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2026-93196

Affected products (as reported)

VendorProductVersions
Linux Linux 6e84200c0a2994b991259d19450eee561029bf70 – before 71ac70fc7f95963eca9d1145a9b02b8fe149eb4f6e84200c0a2994b991259d19450eee561029bf70 – before 41b2025709ec104a07d15540399809ae5851246e6e84200c0a2994b991259d19450eee561029bf70 – before 4691c137e9cbe76137d730a26d663d900ac7279b6e84200c0a2994b991259d19450eee561029bf70 – before be072a5d5e35f4bdf2da22f600b5d6dc6c5ff4916e84200c0a2994b991259d19450eee561029bf70 – before b1e740b9156621afd4c4aa66257f4dde8df1febe6e84200c0a2994b991259d19450eee561029bf70 – before e57140944b5a47a7fd5a142faab29a02af040bc8
Linux Linux 5.3

References