CVE-2026-93261: locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
In the Linux kernel, the following vulnerability has been resolved:
locking/lockdep: Fix NULL pointer dereference in locksetclass()
registerlockclass() can return NULL when the lock class pool is exhausted, graphlock() fails, or key validation fails. However, locksetclass() uses the return value directly in pointer arithmetic without a NULL check:
class = registerlockclass(lock, subclass, 0); hlock->classidx = class - lockclasses;
If class is NULL, this computes a wild offset that corrupts hlock->classidx. The subsequent reacquireheldlocks() call will invoke hlockclass() with this corrupted index, leading to a NULL or out-of-bounds pointer dereference.
Add the missing NULL check, consistent with how lockacquire() already handles this case at the same call site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a NULL check for the return value of register_lock_class() in __lock_set_class() before using class in pointer arithmetic; handle the NULL case consistently with __lock_acquire() to prevent a corrupted hlock->class_idx and subsequent NULL or out-of-bounds dereference.
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
The affected path is reached when register_lock_class() returns NULL. The described reasons are exhaustion of the lock class pool, failure of graph_lock(), or key validation failure.
What is the likely impact when the failure occurs?
The NULL return is used in pointer arithmetic to calculate hlock->class_idx, producing a corrupted index. A later reacquire_held_locks() operation can dereference a NULL or out-of-bounds lock-class pointer.
How can teams determine whether their kernel includes the fix?
Review the kernel source or applied stable patches for a NULL check after register_lock_class() in __lock_set_class(), before hlock->class_idx is assigned. The listed kernel stable references identify patches containing the resolution.