UBUNTU-CVE-2026-93073: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure() daxholdernotifyfailure() reads daxdev->holderops twice without READONCE() -- once for the NULL check and once for the indirect notifyfailure() call. A concurrent fsputdax() can clear holderops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (killdax() also clears holderops, but only after synchronizesrcu(), so it cannot race a reader that is inside daxreadlock(); fsputdax() does no such synchronization.) Fetch holderops once into a local with READONCE() so the NULL check and the indirect call observe the same value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In dax_holder_notify_failure(), fetch dax_dev->holder_ops once into a local variable using READ_ONCE(), then use that same value for both the NULL check and the indirect notify_failure() call.