UBUNTU-CVE-2026-93285: Race Condition
In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fsgckthread in f2fssbinfo Instead of allocating f2fsgckthread dynamically, embed it in f2fssbinfo. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbistore - remount|shutdown - f2fsstopgcthread - access sbi->gcthread - sbi->gcthread = NULL - access sbi->gcthread->f2fsgctask
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most relevant to this issue?
Systems running one of the listed Ubuntu kernel packages are relevant: linux, linux-azure, linux-gcp, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, or linux-realtime. The affected code is in f2fs, so review systems that use the f2fs filesystem.
What operating conditions are implicated by the fix?
The change addresses lifetime handling for the f2fs garbage-collection thread during remount or shutdown and when stopping the GC thread. Those paths can access the GC-thread pointer while teardown clears or uses it.
How can I determine whether my installed package includes the resolution?
The provided data does not include fixed package versions or kernel versions. It states that the vulnerability has been resolved, but version-level verification requires package information not present here.