Race condition in Linux kernel - CVE-2026-93123
Published: September 18, 2026
Vulnerability identifier: #VU150875
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93123
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to discard newly written serial data.
The vulnerability exists due to a race condition in the qcom GENI serial DMA transmit completion path when a stale DMA completion is handled after the transmit FIFO is flushed and new data is written. A local user can cause the stale completion to advance the transmit FIFO and discard the new data.
Exploitation requires the hardware DMA transfer to complete before its completion interrupt is handled.
Affected software
Linux kernel
How to mitigate CVE-2026-93123
Install security update from vendor's repository.