CVE-2026-93196: nvdimm: virtio_pmem: refcount requests for token lifetime
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: virtiopmem: refcount requests for token lifetime
KASAN reports slab-use-after-free in wakeupcommon(): BUG: KASAN: slab-use-after-free in wakeupcommon+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: <IRQ> dumpstacklvl+0x6d/0xb0 printreport+0x170/0x4e2 ? pfxrawspinlockirqsave+0x10/0x10 ? virtaddrvalid+0x1dc/0x380 kasanreport+0xbc/0xf0 ? wakeupcommon+0x114/0x160 ? wakeupcommon+0x114/0x160 wakeupcommon+0x114/0x160 ? pfxrawspinlockirqsave+0x10/0x10 wakeup+0x36/0x60 virtiopmemhostack+0x11d/0x3b0 ? schedbalancedomains+0x29f/0xb00 ? pfxvirtiopmemhostack+0x10/0x10 ? rawspinlockirqsave+0x98/0x100 ? pfxrawspinlockirqsave+0x10/0x10 vringinterrupt+0x1c9/0x5e0 ? pfxvpinterrupt+0x10/0x10 vpvringinterrupt+0x87/0x100 ? pfxvpinterrupt+0x10/0x10 handleirqeventpercpu+0x17f/0x550 ? pfxrawspinlock+0x10/0x10 handleirqevent+0xab/0x1c0 handlefasteoiirq+0x276/0xae0 commoninterrupt+0x65/0x130 commoninterrupt+0x78/0xa0 </IRQ>
virtiopmemhostack() wakes a request that has already been freed by the submitter.
This happens when the request token is still reachable via the virtqueue, but virtiopmemflush() returns and frees it.
Fix the token lifetime by refcounting struct virtiopmemrequest. virtiopmemflush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 1.17.0-2-2 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.19.0-next-20260220-00006-g1eae5f204ec3
Event History
Frequently Asked Questions
Which environments are indicated by the available report?
The report was observed on a Linux kernel running in a QEMU Standard PC virtual machine and involves the virtio_pmem driver. The provided data does not establish exposure for other configurations.
How can I identify a potentially affected system?
A KASAN slab-use-after-free report involving __wake_up_common(), virtio_pmem_host_ack(), vring_interrupt(), and vp_vring_interrupt() is the relevant indicator. The reported failure occurred in interrupt context.
Is a fix available?
Yes. The vulnerability description states that it has been resolved, and three stable kernel commit references are provided.