« Volver al listado

CVE-2026-93261

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

register_lock_class() can return NULL when the lock class pool is exhausted, graph_lock() fails, or key validation fails. However, __lock_set_class() uses the return value directly in pointer arithmetic without a NULL check:

If class is NULL, this computes a wild offset that corrupts hlock->class_idx. The subsequent reacquire_held_locks() call will invoke hlock_class() with this corrupted index, leading to a NULL or out-of-bounds pointer dereference.

Add the missing NULL check, consistent with how __lock_acquire() already handles this case at the same call site.

Detalles técnicos trazas, registros y código del informe original
  class = register_lock_class(lock, subclass, 0);
  hlock->class_idx = class - lock_classes;

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93261",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "f6093ff67ea6e347574819ed23e96e0f82a25ffc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "f56e54fd24f05e9de528fcb77f6084f80c8066ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "5c3bff6cf26e6a54fbf8b893a879c32824d2d50d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "b2113dcd8238bf00ce37a34e67b29cf31d32a545",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "e7c69c6695d84220847cca62a45e879e71e79e9d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "9be10f49dfc2e4b472b3a5f346483b67374774b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64aa348edc617dea17bbd01ddee4e47886d5ec8c",
              "lessThan": "7577e00b9ab506202b9f1a33de3cc8cc6413a4db",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/locking/lockdep.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.27",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/locking/lockdep.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T16:17:22.780",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c3bff6cf26e6a54fbf8b893a879c32824d2d50d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7577e00b9ab506202b9f1a33de3cc8cc6413a4db",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9be10f49dfc2e4b472b3a5f346483b67374774b8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b2113dcd8238bf00ce37a34e67b29cf31d32a545",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e7c69c6695d84220847cca62a45e879e71e79e9d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f56e54fd24f05e9de528fcb77f6084f80c8066ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f6093ff67ea6e347574819ed23e96e0f82a25ffc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/lockdep: Fix NULL pointer dereference in __lock_set_class()\n\nregister_lock_class() can return NULL when the lock class pool is\nexhausted, graph_lock() fails, or key validation fails. However,\n__lock_set_class() uses the return value directly in pointer arithmetic\nwithout a NULL check:\n\n  class = register_lock_class(lock, subclass, 0);\n  hlock->class_idx = class - lock_classes;\n\nIf class is NULL, this computes a wild offset that corrupts\nhlock->class_idx. The subsequent reacquire_held_locks() call will\ninvoke hlock_class() with this corrupted index, leading to a NULL or\nout-of-bounds pointer dereference.\n\nAdd the missing NULL check, consistent with how __lock_acquire() already\nhandles this case at the same call site."
    }
  ],
  "lastModified": "2026-09-24T16:17:22.780",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}