CVE-2026-93821

Received Received - Intake

PCI Hotplug Race Condition in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Protect root bus removal with rescan lock Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. [bhelgaas: commit log]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93821

EUVD

EUVD-2026-86209

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition during PCI root bus removal. The issue occurs when the system stops and removes a root bus without holding the pci_rescan_remove_lock, which protects against concurrent rescan or hotplug operations via sysfs. This can lead to use-after-free errors or system crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's PCI subsystem and may not have direct network detection methods. Monitor kernel logs for PCI-related errors or crashes, particularly during bus rescan operations. Check for use-after-free or system crash events in dmesg or journalctl logs.

Impact Analysis

If exploited, this vulnerability could cause system instability, including crashes or unexpected behavior during PCI device operations. Users might experience data corruption, application failures, or system downtime, particularly in environments with frequent PCI device changes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel PCI subsystem issue. Compliance impacts would depend on system-specific configurations and use cases rather than this specific vulnerability.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for this vulnerability. Avoid triggering PCI bus rescans or hotplug operations unnecessarily until the update is applied. Monitor system stability after updates.

Hi! I’m here to help you understand CVE-2026-93821. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70