CVE-2026-93795
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radix_tree_insert failure When radix_tree_insert() fails in blkg_create(), the error path has two issues: 1. blkg->online is set to true unconditionally, even when the blkg was never fully inserted. Move the assignment inside the success block. 2. The error path calls blkg_put() without first calling percpu_ref_kill(). Because the refcount is still in percpu mode, percpu_ref_put() only does this_cpu_sub() without checking for zero, so blkg_release() is never triggered. This permanently leaks the blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference — the latter preventing the cgroup from ever being destroyed. Fix by replacing blkg_put() with percpu_ref_kill(), matching the pattern used in blkg_destroy().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93795
EUVD
EUVD-2026-86182

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where radix_tree_insert() failure in blkg_create() causes two issues: blkg->online is incorrectly set to true even when insertion fails, and blkg_put() is called without first calling percpu_ref_kill(), leading to memory leaks of blkg structures and preventing cgroup destruction.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to memory leaks in the block I/O controller (blk-cgroup). Detection requires checking kernel logs for blkg-related errors or memory leaks. Commands like dmesg | grep -i blkg or journalctl -k | grep -i blkg may help identify issues. Ensure your kernel version is updated to the patched version.

Impact Analysis

This vulnerability can cause memory leaks in the Linux kernel, leading to resource exhaustion and system instability. It may also prevent proper cleanup of cgroups, causing resource management issues in containerized environments.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Reboot your system after applying the update to ensure the patched kernel is active. Monitor system logs for any signs of memory leaks or blkg-related errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart