HIGH Introduced in 5.3
nvdimm FlushRequest UAF
CVE-2026-93196
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtio_pmem: refcount requests for token lifetime KASAN reports slab-use-after-free in __wake_up_common(): BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x6d/0xb0 print_report+0x170/0x4e2 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __virt_addr_valid+0x1dc/0x380 kasan_report+0xbc/0xf0 ? __wake_up_common+0x114/0x160 ? __wake_up_common+0x114/0x160 __wake_up_common+0x114/0x160 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 __wake_up+0x36/0x60 virtio_pmem_host_ack+0x11d/0x3b0 ? sched_balance_domains+0x29f/0xb00 ? __pfx_virtio_pmem_host_ack+0x10/0x10 ? _raw_spin_lock_irqsave+0x98/0x100 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 vring_interrupt+0x1c9/0x5e0 ? __pfx_vp_interrupt+0x10/0x10 vp_vring_interrupt+0x87/0x100 ? __pfx_vp_interrupt+0x10/0x10 __handle_irq_event_percpu+0x17f/0x550 ? __pfx__raw_spin_lock+0x10/0x10 handle_irq_event+0xab/0x1c0 handle_fasteoi_irq+0x276/0xae0 __common_interrupt+0x65/0x130 common_interrupt+0x78/0xa0 </IRQ> virtio_pmem_host_ack() wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtio_pmem_flush() returns and frees it. Fix the token lifetime by refcounting struct virtio_pmem_request. virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning.
02KernelScan AI Analysis
Risk summary
A use-after-free in the virtio-pmem driver allows an unprivileged guest user to trigger memory corruption by racing the flush completion interrupt handler against the submitting thread's cleanup. The bug requires a guest VM configured with a virtio-pmem device and a DAX-mounted filesystem. Successful exploitation could lead to kernel code execution or denial of service within the guest.
Vulnerability analysis
In the virtio-pmem driver, when a guest performs a flush on a DAX-mounted persistent memory device, the object submitted to the device can be freed by the submitting thread before the interrupt completion handler finishes accessing it. The completion handler runs in interrupt context and wakes the submitter, who then immediately frees the object while the handler is still using it on another CPU. The fix adds reference counting so that the object remains alive until both the submitter and the completion path have each finished with it. This vulnerability is reachable from within a guest VM that has a virtio-pmem device configured, by an unprivileged user performing filesystem flush operations on a DAX-mounted pmem device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.3 | 6.12.112 | 4691c137e9cb |
| 6.18 | 5.3 | 6.18.52 | be072a5d5e35 |
| 6.6 | 5.3 | 6.6.160 | 41b2025709ec |
| 7.2 | 5.3 | 7.2.6 | b1e740b91566 |
| mainline | 5.3 | 7.3 | e57140944b5a |
| cip/6.12 | 5.3 | 6.12.112-cip33 | 4691c137e9cb |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |