CVE-2026-93278
Received Received - Intake

Use-After-Free in Linux Kernel Octeon Driver

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown cvm_oct_rx_shutdown calls free_irq and netif_napi_del without disabling the napi instance first. As the free_irq only waits for completion of hard interrupt handlers, the napi poll function could still be active. If cvm_oct_remove proceeds to free the plat structure (which holds the NAPI instances), the active poll function will access freed memory, resulting in a use-after-free crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93278
EUVD
EUVD-2026-86150

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's staging octeon driver. The cvm_oct_rx_shutdown function fails to disable a NAPI instance before freeing related resources. This allows the NAPI poll function to remain active after memory is freed, causing a crash when it tries to access freed memory.

Detection Guidance

This vulnerability affects the Linux kernel's staging octeon driver. Detection requires checking if the vulnerable code path is present in the running kernel. Inspect kernel logs for crashes related to NAPI or octeon drivers. Use commands like 'dmesg | grep -i napi' or 'lsmod | grep octeon' to check for active instances.

Impact Analysis

This vulnerability could cause system crashes or instability on affected Linux systems using the octeon driver. It may lead to denial-of-service conditions if the use-after-free triggers during normal operation.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. If immediate patching is not possible, disable the octeon driver module using 'modprobe -r octeon' or blacklist it in '/etc/modprobe.d/'. Monitor system stability after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart