Use of uninitialized resource in Linux kernel - CVE-2026-93121

Vulnerability details

The vulnerability allows a local user to cause undefined behavior.

The vulnerability exists due to improper cleanup of an uninitialized dma_fence object in ffs_dmabuf_transfer() when handling an endpoint-disabled or request-allocation failure. A local user can initiate a DMA-buffer transfer that encounters either error condition to cause undefined behavior.

Affected software

How to mitigate CVE-2026-93121

External References

• https://git.kernel.org/stable/c/58952c83dfe6ea3294a74734d2d1018c1120779a
• https://git.kernel.org/stable/c/5fd8baacc7dc477df9cac61b45491840247a9b1e
• https://git.kernel.org/stable/c/621707dc67c9846fd876d7579ec951d92aa033f1
• https://git.kernel.org/stable/c/be539138d9a187af3b884525a395db10797c64f1

Related Security Bulletins

• Use of uninitialized resource in Linux kernel gadget function driver