CVE-2026-93815
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: au1000: move free_irq out of the close-time spinlocked section au1000_close() calls free_irq() while aup->lock is still held with spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ descriptor request mutex, so it does not belong inside the close-time spinlocked section. This was found by our static analysis tool and then confirmed by manual review of the in-tree au1000_close() .ndo_stop path. The reviewed path keeps aup->lock held across the MAC reset, queue stop and free_irq(dev->irq, dev). A directed runtime validation kept that ndo_stop carrier and the same free_irq(dev->irq, dev) operation under the driver lock. Lockdep reported "BUG: sleeping function called from invalid context" and "Invalid wait context" while free_irq() was taking desc->request_mutex, with au1000_close() and free_irq() on the stack. Drop aup->lock before freeing the IRQ. The protected close-time work still stops the device and queue before IRQ teardown, but the sleepable IRQ core path now runs outside the spinlocked section.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93815
EUVD
EUVD-2026-86203

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the au1000 network driver's close function. The issue occurs because free_irq() is called while holding a spinlock (aup->lock) in au1000_close(). Since free_irq() can sleep by acquiring a mutex, this violates the non-sleeping requirement of spinlocked sections. The fix moves free_irq() outside the spinlocked section to prevent invalid context errors.

Detection Guidance

This vulnerability is specific to the Linux kernel's au1000 driver and involves a spinlock issue during IRQ freeing. Detection requires checking the kernel version and au1000 driver implementation. Use 'uname -a' to check kernel version and 'lsmod | grep au1000' to see if the driver is loaded.

Impact Analysis

This vulnerability could cause system instability or crashes on systems using the au1000 network driver. It may lead to kernel panics or unexpected behavior when network interfaces are brought down, as the improper locking could corrupt kernel memory or trigger 'sleeping function called from invalid context' errors.

Mitigation Strategies

Apply the latest kernel update from your distribution to ensure the au1000 driver fix is included. If the driver is not in use, consider blacklisting it via 'echo 'blacklist au1000' >> /etc/modprobe.d/blacklist.conf' and rebooting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93815. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart