Memory corruption in Linux kernel - CVE-2026-93148
Published: September 18, 2026
Vulnerability identifier: #VU150865
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93148
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to access memory beyond allocated object bounds.
The vulnerability exists due to improper bounds checking in the BPF verifier BTF struct-walking logic when validating BPF program accesses to MEM_ALLOC objects. A local user can load a BPF program that accesses beyond the static BTF type size to access memory beyond allocated object bounds.
The issue also affects struct ID matching used for kfunc and kptr type checks.
Affected software
Linux kernel
How to mitigate CVE-2026-93148
Install security update from vendor's repository.