FKIE_CVE-2026-93279

Vulnerability from fkie_nvd - Published: 2026-09-24 16:17 - Updated: 2026-09-24 16:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in the queue which might run after the cvm_oct_remove() frees net_device structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it iterates cvm_oct_device[] which is an array of netdevice pointers. Add tasklet_kill() after free_irq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/octeon/ethernet-tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "d15226338dfaa84ffff142d32723cdf74d0c47c4",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "b6365e4186322858a82c8713b1d0bd209c8e765a",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "03d12490afd1198310ad0aba42462329832eb739",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "2c0c9956596e48654bb4855e2a0742748a0826a7",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "41a79bd9e5a74f8f483b3b206d10567912874fb4",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            },
            {
              "lessThan": "b9af44b0d20b2247c4eb0ea5cfca907d643eea50",
              "status": "affected",
              "version": "4898c560103fb8075c10a8e9d70e0ca26873075e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/octeon/ethernet-tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown\n\nThe TX cleanup tasklet can be scheduled by the watchdog IRQ handler\nto execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in\nthe queue which might run after the cvm_oct_remove() frees net_device\nstructures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it\niterates cvm_oct_device[] which is an array of netdevice pointers.\nAdd tasklet_kill() after free_irq() to ensure the tasklet is no longer\nscheduled or running before teardown proceeds."
    }
  ],
  "id": "CVE-2026-93279",
  "lastModified": "2026-09-24T16:17:25.147",
  "metrics": {},
  "published": "2026-09-24T16:17:25.147",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.