CVE-2026-93827

Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves dangling pointers in struct virtio_fs and can trigger a double-free during probe failure cleanup. Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the virtio_fs_setup_vqs() error path so that the later kobject release sees an uninitialized state and kfree(NULL) becomes harmless. This can be reproduced when a broken virtio-fs device advertises more request queues than the transport actually provides. In that case virtio_find_vqs() fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93827

EUVD

EUVD-2026-86216

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9
Linux	Linux	a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9
Linux	Linux	a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9
Linux	Linux	6.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's virtio-fs driver. During device probe, memory for request queues and mappings is allocated but if setup fails, the error path frees this memory. Later, the kobject release path attempts to free the same memory again, causing a double-free that can lead to crashes or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio-fs subsystem and requires kernel-level inspection. Detection involves checking kernel logs for virtio-fs probe failures or double-free errors during device initialization. Use dmesg | grep virtio_fs or journalctl -k | grep virtio_fs to review kernel messages. If a broken virtio-fs device is present, these commands may show errors related to queue setup failures.

Impact Analysis

If you use a virtual machine with virtio-fs and the guest kernel is vulnerable, a broken virtio-fs device could trigger a kernel crash or instability. This may cause data loss or denial of service on the affected system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue in the virtio-fs subsystem. Standards like GDPR and HIPAA focus on data protection, privacy, and security controls, while this issue relates to a double-free bug during device probe failure cleanup in the Linux kernel.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. If updating is not immediately possible, disable virtio-fs devices in your virtual machine configurations or hypervisor settings to prevent the vulnerable code path from being triggered. Monitor kernel logs for any signs of probe failures after mitigation.

Hi! I’m here to help you understand CVE-2026-93827. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70