Cloudanix VulnDB

CVE-2026-93134

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's way of printing messages to the screen or logs could let attackers mess with memory they should not touch, risking crashes or worse.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in printk legacy console emission where a console struct pointer can be dereferenced after an SRCU read lock release during context handover, allowing invalid memory access.

Why it matters to the business

Potential kernel instability, crashes, or limited code execution on Linux systems that rely on console output, increasing operational risk for servers and embedded devices until patched.

How an attack unfolds

An attacker triggers legacy record emission paths that perform a console handover, releases the SRCU lock, then reuses the now-invalid console pointer before the check in console_flush_one_record, leading to memory corruption.

How to fix it

Apply the upstream printk fix that moves console usage after the handover check in console_flush_one_record; update to a kernel containing the resolution for CVE-2026-93134.

How to confirm the fix worked

Confirm kernel source contains the post-emit handover verification before further @con usage; test console output under high-contention legacy printing scenarios.

Typical attack path

  1. Gain ability to influence printk emission (local or via device logging)
  2. Force a legacy printing context handover
  3. Bypass the missing post-emit handover check
  4. Access or corrupt freed console struct memory

How to detect it

Review kernel logs and crash dumps for console-related use-after-free signatures or unexpected handovers during printk; correlate with process activity that generates high-volume legacy console output.

What your security team should do

  • Prioritize kernel updates for systems with heavy console or serial logging
  • Monitor for related printk changes in stable branches
  • Limit untrusted local access on unpatched kernels

The record

In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage. Sashiko pointed out that console_flush_one_record() was not doing this. In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check.

Affected packages

Ecosystem Package Introduced Fixed