VulnerabilityPublished 24 Sep 2026Updated 30 Oct 2026

CVE-2026-93208: Linux kernel · kasan: fix cache shrink race with CPU hotplug

Source GCVE Database

Compare

Authoritative record:CVE-2026-93208· Low

Not known to be exploited · fixed in eab61c0781cbe899e074c0009af304f3b337e0c9 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 18:03 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in eab61c0781cbe899e074c0009af304f3b337e0c9, 8790303cbaac52a11dfed4aab261f8ea60682525, 3119d58e4ef8719d669911d38a53fc00086ac48b +3

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-fgp6-x4jf-pff3

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < eab61c0781cbe899e074c0009af304f3b337e0c9	Fixed in eab61c0781cbe899e074c0009af304f3b337e0c9
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < 8790303cbaac52a11dfed4aab261f8ea60682525	Fixed in 8790303cbaac52a11dfed4aab261f8ea60682525
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < 3119d58e4ef8719d669911d38a53fc00086ac48b	Fixed in 3119d58e4ef8719d669911d38a53fc00086ac48b
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < 709c3646545e0a1f99a5816384c633f6552c5a98	Fixed in 709c3646545e0a1f99a5816384c633f6552c5a98
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < 30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3	Fixed in 30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3
LinuxLinux	Affected ≥ 07d067e4f2ceb72b9f681995cc53828caaba9e6e, < 7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a	Fixed in 7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a

AI-suggested

A fix is available that changes the cache shrink and destroy paths to iterate over all possible CPUs instead of only online CPUs, ensuring that objects on per-CPU shrink lists are properly freed even if CPUs go offline. Users should apply the official Linux kernel update that includes this fix. No additional mitigation is required beyond applying the patch.

Description

A race condition in the Linux kernel's KASAN (Kernel Address Sanitizer) cache shrink mechanism during CPU hotplug operations can cause objects to remain on per-CPU shrink lists. This prevents proper release of slab cache objects, potentially causing memory to not be freed correctly. The issue was observed with the virtio-9p filesystem where unmount operations left objects in the cache, leading to kernel warnings about objects remaining on cache shutdown.

Impact

Objects belonging to slab caches may remain unfreed if CPUs go offline during cache shrink operations, potentially causing memory to be retained longer than expected and leading to kernel warnings or errors during cache destruction. This could affect system stability or resource usage but does not directly indicate memory corruption or escalation. The issue was observed causing kernel BUG warnings during unmount of the virtio-9p filesystem.

Summary

The vulnerability involves a race condition between kmem_cache_shrink() and CPU hotplug events. kmem_cache_shrink() moves objects from cpu_quarantine to per-CPU shrink_qlists for later freeing, iterating only over online CPUs. If a CPU goes offline during this process, its shrink_qlist is not drained, leaving objects unfreed. This can cause kmem_cache_destroy() to report objects remaining in the cache, as it also skips offline CPUs. The flaw was demonstrated with the virtio-9p filesystem where mount and umount succeeded but kernel logs showed objects remaining on cache shutdown. The fix involves iterating over all possible CPUs (not just online ones) to drain shrink_qlists, ensuring objects are freed even if CPUs go offline during cache shrink or destroy operations.

References

Community reviews

Loading reviews…