Improper initialization in Linux kernel - CVE-2026-93183
Published: September 18, 2026
Vulnerability identifier: #VU150812
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93183
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper initialization order in lima_device_init() when initializing the Lima device. A local user can trigger creation of an empty Lima VM before its allocation range is configured to cause a denial of service.
The kernel BUG condition is triggered when DRM_DEBUG_MM is enabled.
Affected software
Linux kernel
How to mitigate CVE-2026-93183
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9
- https://git.kernel.org/stable/c/788917ba77f5d69bd368c1d176ecceda346a2951
- https://git.kernel.org/stable/c/79a3331ee436c8b1454f897d539606c9b5ebdf9f
- https://git.kernel.org/stable/c/ad4e908096dff97646f77b04e2e2825225e215f7
- https://git.kernel.org/stable/c/af1f276d50c9d7ebcd25770f358ca503a89d96d7
- https://git.kernel.org/stable/c/e0773ad25a34a49aece176721c466cf214e02222
- https://git.kernel.org/stable/c/e2a7cee341986cb5b544a8286edc7fb0494c592e
- https://git.kernel.org/stable/c/fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95a