Use-after-free in Linux kernel - CVE-2026-93267

Vulnerability details

The vulnerability allows a local user to access a dmah after its vendor-specific resources have been freed.

The vulnerability exists due to use-after-free in uverbs_free_dmah() when accessing a dmah through the netlink path. A local user can access a dmah through restrack while its destruction is in progress to access a dmah after its associated resources have been freed.

Affected software

How to mitigate CVE-2026-93267

External References

• https://git.kernel.org/stable/c/2696626a0be5877f445fb647c25ef43930c777e6
• https://git.kernel.org/stable/c/8b22722f45a29a7c0900b1d4d0bc5da5492ece10
• https://git.kernel.org/stable/c/bfc119a40c04bbe3daad826f2160ccbfae6c64ce

Related Security Bulletins

• Use-after-free in Linux kernel infiniband core driver