Race condition in Linux kernel - CVE-2026-93096

Vulnerability identifier: #VU150919

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-93096

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to corrupt the device's transfer context.

The vulnerability exists due to a race condition in cxl_get_feature() and cxl_set_feature() when concurrent multi-part Get or Set Feature transfers are processed. A local user can issue concurrent feature requests to corrupt the device's transfer context.

The issue affects transfers whose payloads exceed the mailbox payload size.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/7682b617db1f19bc606b5f1badadcf1e63a87b14
• https://git.kernel.org/stable/c/77b814c1832fde018c30357b4ec3fcdaa91a1c10

• Race condition in Linux kernel cxl
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more