CVE-2026-93215
Received Received - Intake

Double Free in Linux Kernel CDX Subsystem

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This leaves a dangling pointer in the array. Then cdx_destroy_res_attr() frees the already-freed memory. Fix the double free by initializing cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93215
EUVD
EUVD-2026-85944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double-free issue in the Linux kernel's cdx driver. When creating a sysfs binary file fails, the code incorrectly frees memory but leaves a dangling pointer. Later, when attempting to destroy the resource, it frees the already-freed memory again, causing a crash or potential code execution.

Detection Guidance

This vulnerability involves a double free in the Linux kernel's cdx driver when sysfs file creation fails. Detection requires checking kernel logs for sysfs creation failures or memory corruption errors in cdx-related modules. Use commands like dmesg | grep cdx or journalctl -k | grep cdx to inspect kernel logs for errors.

Impact Analysis

This could cause system instability, crashes, or potential privilege escalation if exploited. Systems using the affected cdx driver may experience kernel panics or unexpected behavior due to memory corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is a double-free memory error in the Linux kernel's cdx subsystem, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the double free issue in the cdx driver. Reboot the system after patching to ensure the updated kernel is active. Monitor kernel logs for any recurring sysfs creation failures or memory corruption errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart