CVE-2026-97941
Received Received - Intake

Race Condition in Linux Kernel Slab Allocator

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds. However, as reported by Hyunwoo Kim [1], other CPUs might have freed an object to the slab, insert the slab to the partial list, then allocated an object from the slab, and be in the middle of removing the slab from the list under n->list_lock. Since __refill_objects_node() puts the slab back on pc.slabs outside n->list_lock, it might insert the slab into that list while the slab is concurrently being removed from n->partial. This led to a list corruption [1]: list_add corruption. next->prev should be prev (ffff888100000248), but was dead000000000122. (next=ffffea000416e410). kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted 7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy) RIP: 0010:__list_add_valid_or_report+0x80/0xd0 ... Call Trace: alloc_from_new_slab+0x183/0x300 ___slab_alloc+0x31c/0x890 __kmalloc_noprof+0x3d4/0x800 lsm_blob_alloc+0x2d/0x50 security_msg_msg_alloc+0x26/0x90 load_msg+0x1aa/0x210 do_msgsnd+0x91/0x800 do_syscall_64+0x109/0x5d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Kernel panic - not syncing: Fatal exception This is a classic ABA problem where cmpxchg succeeds but the state has changed since __refill_objects_node() took the freelist from the slab. As Vlastimil Babka mentioned [2], it should be rare to return more than one slab (due to the racy read of slab->counters in get_partial_node_bulk()). Therefore, instead of introducing additional complexity, acquire and release n->list_lock twice in the worst case. Return the slab directly to the partial list and hold n->list_lock across the cmpxchg and add_partial(). This is similar to the initial version of commit ba7425312607 [3]. This is enough to avoid the race as the list manipulation is serialized by n->list_lock. While at it, bring back unlikely() hint now that the condition is unlikely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97941
EUVD
EUVD-2026-86795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 7.2.0-16172-gcf72cbb39da8-dirty

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's memory management subsystem. It occurs in the slab allocator when multiple CPUs try to free and allocate objects simultaneously. The vulnerability arises because the code incorrectly assumes no other CPU can modify the slab's state while checking and updating its freelist. This leads to a classic ABA problem where a compare-and-exchange operation succeeds even though the underlying state has changed due to concurrent operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management subsystem and may not have direct detection commands. However, you can check for kernel oops or panic logs indicating list corruption or slab-related errors. Monitor system logs for messages like 'list_add corruption' or 'kernel BUG at lib/list_debug.c'.

Impact Analysis

This vulnerability can cause kernel memory corruption, leading to system crashes, kernel panics, or arbitrary code execution. It may result in denial-of-service conditions where the system becomes unresponsive or requires a reboot. Systems running unpatched Linux kernels are vulnerable.

Compliance Impact

This vulnerability is a kernel-level memory management issue in the Linux kernel that could lead to memory corruption and system instability. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance with these standards typically involves data protection, access controls, and audit logging, which are not impacted by this specific kernel race condition.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. The patch addresses the race condition in mm/slab.c by properly handling slab freelist operations under n->list_lock. Check your distribution's security advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart