UBUNTU-CVE-2026-93196: Use After Free
In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtiopmem: refcount requests for token lifetime KASAN reports slab-use-after-free in wakeupcommon(): BUG: KASAN: slab-use-after-free in wakeupcommon+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: <IRQ> dumpstacklvl+0x6d/0xb0 printreport+0x170/0x4e2 ? pfxrawspinlockirqsave+0x10/0x10 ? virtaddrvalid+0x1dc/0x380 kasanreport+0xbc/0xf0 ? wakeupcommon+0x114/0x160 ? wakeupcommon+0x114/0x160 wakeupcommon+0x114/0x160 ? pfxrawspinlockirqsave+0x10/0x10 wakeup+0x36/0x60 virtiopmemhostack+0x11d/0x3b0 ? schedbalancedomains+0x29f/0xb00 ? pfxvirtiopmemhostack+0x10/0x10 ? rawspinlockirqsave+0x98/0x100 ? pfxrawspinlockirqsave+0x10/0x10 vringinterrupt+0x1c9/0x5e0 ? pfxvpinterrupt+0x10/0x10 vpvringinterrupt+0x87/0x100 ? pfxvpinterrupt+0x10/0x10 handleirqeventpercpu+0x17f/0x550 ? pfxrawspinlock+0x10/0x10 handleirqevent+0xab/0x1c0 handlefasteoiirq+0x276/0xae0 commoninterrupt+0x65/0x130 commoninterrupt+0x78/0xa0 </IRQ> virtiopmemhostack() wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtiopmemflush() returns and frees it. Fix the token lifetime by refcounting struct virtiopmemrequest. virtiopmemflush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Refcount struct virtio_pmem_request so virtio_pmem_flush() holds a submitter reference and the virtqueue holds an additional reference after the request is queued; release the virtqueue reference on completion and the submitter reference after virtio_pmem_flush() returns.
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems running one of the listed Ubuntu kernel packages are relevant, particularly virtual machines using the virtio_pmem driver. The reported failure occurred on QEMU virtual hardware and involves virtio_pmem request-token lifetime handling.
What level of access does an attacker need?
The supplied severity vector indicates local access, low privileges, no user interaction, high attack complexity, and additional attack requirements. The data does not identify the specific local interface or workload needed to trigger the flaw.
What is the likely impact if exploitation succeeds?
The vulnerability is a use-after-free in the kernel's virtio_pmem handling. The supplied vector rates confidentiality, integrity, and availability impact as high.
How can I determine whether a system is affected?
Check whether the host runs one of the listed Ubuntu Linux kernel package variants and whether virtio_pmem is in use. The provided data does not include affected or fixed package-version ranges.