HIGH Introduced in 6.12
printk ConsoleFlush UAF
CVE-2026-93134
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage. Sashiko pointed out that console_flush_one_record() was not doing this. In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Linux kernel's legacy console printing path. After emitting a record, a handover to another printing context can release the console SRCU read lock, but the code continued to dereference the console pointer before checking for the handover. Any local user who can trigger kernel log activity could potentially exploit this race to achieve memory corruption, leading to privilege escalation or denial of service.
Vulnerability analysis
In the kernel's console printing path, after a message record is emitted, control can hand over to another printing context. When that happens, the internal protection on the console is released and the console pointer may become invalid. The original code used that pointer immediately after the emit step but before checking whether a handover had occurred, creating a window where a freed or reused console object could be accessed. The fix moves the console pointer usage to after the handover check, so it is only touched while the internal protection is still active. Any local user who can generate kernel log activity can reach this code, because the console flush path runs automatically in response to message emission. No special privileges or hardware are needed, though exploiting the bug requires winning a narrow timing race during console handover.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12 | 6.12.110 | f0104a7b730d |
| 6.18 | 6.12 | 6.18.52 | fbf9bb81b215 |
| mainline | 6.12 | 7.3-rc1 | 36630cafbeed |
| 7.2 | 6.12 | 7.2.6 | 8f194dee0c0d |
| cip/6.12 | 6.12 | 6.12.111-cip32 | f0104a7b730d |