CVE-2026-93196

What it actually does

Use-after-free in virtio_pmem request handling: virtio_pmem_host_ack wakes a struct virtio_pmem_request that the submitter has already freed after the token remains reachable on the virtqueue, causing slab corruption in __wake_up_common.

Why it matters to the business

Kernel crashes or memory corruption on affected Linux systems using virtio_pmem devices, potentially leading to denial of service or local privilege escalation in virtualized environments; low exploitability reduces immediate risk but still requires prompt patching on high-value hosts.

How an attack unfolds

An attacker with local access crafts a sequence of virtio_pmem flush operations that race the request submitter's free against the virtqueue completion path; the freed request is later woken, triggering the use-after-free.

How to fix it

Update the Linux kernel to a version containing the refcount fix for struct virtio_pmem_request; ensure both the submitter reference and virtqueue reference are properly dropped.

How to confirm the fix worked

Boot a patched kernel and confirm absence of KASAN reports during virtio_pmem stress tests; verify the refcount increments and decrements appear in the virtio_pmem_flush and completion paths via code review or ftrace.

Typical attack path

1. Obtain local code execution on a Linux guest or host using virtio_pmem
2. Trigger repeated virtio_pmem_flush operations to queue and complete requests
3. Race the submitter's free with the host_ack completion path
4. Trigger __wake_up on the dangling request token to corrupt kernel memory

How to detect it

Search kernel logs for KASAN slab-use-after-free reports mentioning __wake_up_common and virtio_pmem_host_ack; inspect crash dumps for dangling virtio_pmem_request objects referenced after free.

What your security team should do

• Prioritize kernel updates on systems exposing virtio_pmem devices within 30 days
• Monitor for KASAN or slab corruption logs involving __wake_up_common and virtio_pmem
• Limit untrusted local access on virtualized hosts using persistent memory backends until patched