CVE-2026-93262 (GCVE-0-2026-93262)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:52 – Updated: 2026-09-25 05:09
VLAI
Title
md/raid5-ppl: fix use-after-free in ppl_do_flush()
Summary
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free. Add a break statement to stop the loop once io is freed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < cf01f9413565e86673baf927291a088b6975692b (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < e7505842f1329ece90cb9ea0db87772aeca44052 (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < b5123bf667ac29ddd8106f9ca7cc01316513ae66 (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < e77c80670f2c2bf491da9b173931e1da4677c23a (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < 8914c3d40870f16429a326e97e4016bedc6ede4c (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < 455b56209f9615c3902dcc398dd867abb5ade3ab (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < fcf21df7d3c50c8ebeb0757df5d21b02dcae4218 (git)
Affected: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 , < 371f7a1b392edc8b7cf449cc7713179b588f2d0e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5-ppl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf01f9413565e86673baf927291a088b6975692b",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "e7505842f1329ece90cb9ea0db87772aeca44052",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "b5123bf667ac29ddd8106f9ca7cc01316513ae66",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "e77c80670f2c2bf491da9b173931e1da4677c23a",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "8914c3d40870f16429a326e97e4016bedc6ede4c",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "455b56209f9615c3902dcc398dd867abb5ade3ab",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "fcf21df7d3c50c8ebeb0757df5d21b02dcae4218",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "371f7a1b392edc8b7cf449cc7713179b588f2d0e",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5-ppl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io-\u003epending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The patched ppl_do_flush() runs from ppl_stripe_write_finished() after RAID5 stripe data+parity I/O completes. Those writes enter via md_submit_bio() -\u003e raid5_make_request() from local write(2) to a filesystem or /dev/md*; ppl_submit_iounit() only sets disk_flush_bitmap from local stripe R5_Wantwrite/wb_cache_on state, not from a network protocol message.\nAC:L - Writes the attacker issues are logged by ppl_write_stripe()/ppl_log_stripe() and ppl_submit_iounit() sets disk_flush_bitmap for child_logs[i].wb_cache_on members. When pending_stripes hits 0, ppl_stripe_write_finished() calls ppl_do_flush(); the remainder loop\u0027s missing break after ppl_io_unit_finished() is a logic bug on that path, not a second-actor race or a disk-fault precondition.\nPR:L - md_submit_bio() and raid5_make_request() have no capability check; md_ioctl()\u0027s capable(CAP_SYS_ADMIN) applies only to array-management ioctls, not I/O. An unprivileged user who can write a filesystem on the RAID5+PPL array (or /dev/md* with disk-group write access) reaches ppl_do_flush() without init-namespace root.\nUI:N - The attacker triggers ppl_do_flush() through their own writes: raid5 handle_stripe()/handle_stripe_clean_event() calls ppl_stripe_write_finished() on I/O they submitted. No victim action such as mounting an image or plugging a device is required.\nS:U - ppl_io_unit_finished() mempool_free()s the ppl_io_unit from ppl_conf-\u003eio_pool in the host md/raid5 kernel. The later dangling atomic_dec_and_test(\u0026io-\u003epending_flushes) in ppl_do_flush() stays in that kernel\u0027s authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - ppl_io_unit_finished() returns the ppl_io_unit to io_pool via mempool_free(); ppl_do_flush()\u0027s remainder loop then does atomic_dec_and_test(\u0026io-\u003epending_flushes) on that freed kmem_cache object. A UAF of the recycled io_unit header is a kernel read primitive against adjacent/reconstituted pool memory.\nI:H - The same dangling io is a writeable ppl_io_unit: atomic_dec_and_test() mutates pending_flushes on a recycled object, and another true dec_and_test would call ppl_io_unit_finished() again (list_del/mempool_free of a live unit). That is a kernel write/double-free primitive on the PPL io_unit cache.\nA:H - Use-after-free of the mempool ppl_io_unit in ppl_do_flush() after ppl_io_unit_finished() can oops on the stale pending_flushes access or corrupt list_del() pointers in a second finish, panicking the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:54.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66"
        },
        {
          "url": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218"
        },
        {
          "url": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e"
        }
      ],
      "title": "md/raid5-ppl: fix use-after-free in ppl_do_flush()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93262",
    "datePublished": "2026-09-24T15:52:01.886Z",
    "dateReserved": "2026-09-17T16:02:15.097Z",
    "dateUpdated": "2026-09-25T05:09:54.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93262",
      "date": "2026-09-25",
      "epss": "0.00149",
      "percentile": "0.03383"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid5-ppl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cf01f9413565e86673baf927291a088b6975692b",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7505842f1329ece90cb9ea0db87772aeca44052",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5123bf667ac29ddd8106f9ca7cc01316513ae66",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e77c80670f2c2bf491da9b173931e1da4677c23a",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8914c3d40870f16429a326e97e4016bedc6ede4c",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "455b56209f9615c3902dcc398dd867abb5ade3ab",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fcf21df7d3c50c8ebeb0757df5d21b02dcae4218",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "371f7a1b392edc8b7cf449cc7713179b588f2d0e",
                    "status": "affected",
                    "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/raid5-ppl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io-\u003epending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."
          }
        ],
        "id": "CVE-2026-93262",
        "lastModified": "2026-09-25T05:17:01.250",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T16:17:22.927",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-25T23:49:29Z",
      "cve": "CVE-2026-93262",
      "id": "CVE-2026-93262",
      "initial_release_date": "2026-09-24T23:48:51Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93262",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93262.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.