{"id":26053,"date":"2026-09-18T04:32:17","date_gmt":"2026-09-17T20:32:17","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93196"},"modified":"2026-09-18T04:32:17","modified_gmt":"2026-09-17T20:32:17","slug":"cve-2026-93196","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93196","title":{"rendered":"CVE-2026-93196 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: virtio_pmem:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvdimm: virtio_pmem: refcount requests for token lifetime<\/p>\n<p>KASAN reports slab-use-after-free in __wake_up_common():<br \/>\nBUG: KASAN: slab-use-after-free in __wake_up_common+0x114\/0x160<br \/>\nRead of size 8 at addr ffff88810fdcb710 by task swapper\/0\/0<\/p>\n<p>CPU: 0 UID: 0 PID: 0 Comm: swapper\/0 Not tainted<br \/>\n6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)<br \/>\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux<br \/>\n1.17.0-2-2 04\/01\/2014<br \/>\nCall Trace:<\/p>\n<p> dump_stack_lvl+0x6d\/0xb0<br \/>\n print_report+0x170\/0x4e2<br \/>\n ? __pfx__raw_spin_lock_irqsave+0x10\/0x10<br \/>\n ? __virt_addr_valid+0x1dc\/0x380<br \/>\n kasan_report+0xbc\/0xf0<br \/>\n ? __wake_up_common+0x114\/0x160<br \/>\n ? __wake_up_common+0x114\/0x160<br \/>\n __wake_up_common+0x114\/0x160<br \/>\n ? __pfx__raw_spin_lock_irqsave+0x10\/0x10<br \/>\n __wake_up+0x36\/0x60<br \/>\n virtio_pmem_host_ack+0x11d\/0x3b0<br \/>\n ? sched_balance_domains+0x29f\/0xb00<br \/>\n ? __pfx_virtio_pmem_host_ack+0x10\/0x10<br \/>\n ? _raw_spin_lock_irqsave+0x98\/0x100<br \/>\n ? __pfx__raw_spin_lock_irqsave+0x10\/0x10<br \/>\n vring_interrupt+0x1c9\/0x5e0<br \/>\n ? __pfx_vp_interrupt+0x10\/0x10<br \/>\n vp_vring_interrupt+0x87\/0x100<br \/>\n ? __pfx_vp_interrupt+0x10\/0x10<br \/>\n __handle_irq_event_percpu+0x17f\/0x550<br \/>\n ? __pfx__raw_spin_lock+0x10\/0x10<br \/>\n handle_irq_event+0xab\/0x1c0<br \/>\n handle_fasteoi_irq+0x276\/0xae0<br \/>\n __common_interrupt+0x65\/0x130<br \/>\n common_interrupt+0x78\/0xa0<\/p>\n<p>virtio_pmem_host_ack() wakes a request that has already been freed by the<br \/>\nsubmitter.<\/p>\n<p>This happens when the request token is still reachable via the virtqueue,<br \/>\nbut virtio_pmem_flush() returns and frees it.<\/p>\n<p>Fix the token lifetime by refcounting struct virtio_pmem_request.<br \/>\nvirtio_pmem_flush() holds a submitter reference, and the virtqueue holds an<br \/>\nextra reference once the request is queued. The completion path drops the<br \/>\nvirtqueue reference, and the submitter drops its reference before<br \/>\nreturning.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nvdimm: virtio_pmem: refcount requests for token lifetime<\/p>\n<p>KASAN reports slab-use-after-free in __wake_up_common():<br \/>\nBUG: KASAN: sla<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26053","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}