CVE-2026-93262

Received Received - Intake

Use-After-Free in Linux Kernel md/raid5-ppl

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free. Add a break statement to stop the loop once io is freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93262

EUVD

EUVD-2026-86134

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RAID5-PPL (Persistent Parity Log) implementation. The issue occurs in the ppl_do_flush() function where a loop continues to access memory after it has been freed via ppl_io_unit_finished(), leading to potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's md/raid5-ppl module. Detection requires checking for kernel logs or crashes related to md/raid5-ppl use-after-free issues. Monitor system logs for md-related errors or kernel panics. No direct commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or unauthorized code execution on affected Linux systems using RAID5 with PPL. Users might experience data corruption or denial-of-service conditions.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's md/raid5-ppl module, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel memory management issues.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update your kernel to the latest stable version that includes the fix for CVE-2026-93262. Restart systems using affected md/raid5-ppl configurations after patching.

Hi! I’m here to help you understand CVE-2026-93262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70