VulnerabilityPublished 17 Sep 2026Updated 19 Oct 2026

CVE-2026-93106: Linux kernel · crash_dump: release keyring reference at the correct time

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ed566979f99c5516cad45a76ae25e2a4928ffb67 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ed566979f99c5516cad45a76ae25e2a4928ffb67, b0f7343a002f9c8b8378011f60482c76f3216dfd, ada2e5a44e99113e08ad9b7b71396c6c572204da

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to ed566979f99c5516cad45a76ae25e2a4928ffb67, b0f7343a002f9c8b8378011f60482c76f3216dfd or ada2e5a44e99113e08ad9b7b71396c6c572204da.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 62f17d9df6924cf805de5ae970470615c1c8d9f2, < ed566979f99c5516cad45a76ae25e2a4928ffb67	Fixed in ed566979f99c5516cad45a76ae25e2a4928ffb67
LinuxLinux	Affected ≥ 62f17d9df6924cf805de5ae970470615c1c8d9f2, < b0f7343a002f9c8b8378011f60482c76f3216dfd	Fixed in b0f7343a002f9c8b8378011f60482c76f3216dfd
LinuxLinux	Affected ≥ 62f17d9df6924cf805de5ae970470615c1c8d9f2, < ada2e5a44e99113e08ad9b7b71396c6c572204da	Fixed in ada2e5a44e99113e08ad9b7b71396c6c572204da
LinuxLinux	Affected =6.16	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: crash_dump: release keyring reference at the correct time restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to add_key_to_keyring() for each saved key, but add_key_to_keyring() drops that reference on every call. This is only balanced when exactly one key is restored. With multiple keys, the keyring reference is dropped too many times and may trigger a refcount underflow or use-after-free. When more than five keys are restored, a refcount underflow/use-after-free warning can be triggered. The early error paths after lookup_user_key() also return without dropping the keyring reference. Keep ownership of the keyring reference in restore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths, and make add_key_to_keyring() only use the reference without consuming it.

References

Community reviews

Loading reviews…