CVE-2026-93278: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
staging: octeon: add missing napidisable in cvmoctrxshutdown
cvmoctrxshutdown calls freeirq and netifnapidel without disabling the napi instance first. As the freeirq only waits for completion of hard interrupt handlers, the napi poll function could still be active. If cvmoctremove proceeds to free the plat structure (which holds the NAPI instances), the active poll function will access freed memory, resulting in a use-after-free crash.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel staging Octeon network driver are exposed during driver shutdown or device removal. The affected path is cvm_oct_rx_shutdown, followed by cvm_oct_remove freeing the platform structure.
What conditions are required to trigger the use-after-free?
A NAPI poll function must still be active when shutdown frees the interrupt and removes NAPI without first disabling that NAPI instance. If removal then frees the platform structure holding the NAPI instances, the active poll function can access freed memory and crash the system.
Is there a documented mitigation if the fix cannot be applied immediately?
No alternative mitigation is provided in the available data. The documented resolution is to disable the NAPI instance during cvm_oct_rx_shutdown before freeing the IRQ and deleting NAPI.