CVE-2026-93073
dax: read holder_ops once in dax_holder_notify_failure()
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: dax: read holder_ops once in dax_holder_notify_failure() dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() -- once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (kill_dax() also clears holder_ops, but only after synchronize_srcu(), so it cannot race a reader that is inside dax_read_lock(); fs_put_dax() does no such synchronization.) Fetch holder_ops once into a local with READ_ONCE() so the NULL check and the indirect call observe the same value.
References
- https://git.kernel.org/stable/c/1661b9bf78def01a8c96409569772d9b2592f4ba
- https://git.kernel.org/stable/c/0a42180d5410c98829ee72d1d426fb7faf9e6873
- https://git.kernel.org/stable/c/ee1251621d1c7cf3155c6704542cbb358d799968
- https://git.kernel.org/stable/c/6a37acecc7c29136235cbc446a1b89e81414344b
- https://git.kernel.org/stable/c/eb412f80311fc7ab6eb3203091a3fe59a5e9fd30
- https://git.kernel.org/stable/c/7ae9d15bdcde0f2955ae13b6a95587f9e23b2359
European references
- ENISA EUVD · EUVD-2026-82183
- GCVE · GCVE-0-2026-93073
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 8012b866085523758780850087102421dbcce522 < 1661b9bf78def01a8c96409569772d9b2592f4ba ; affected 8012b866085523758780850087102421dbcce522 < 0a42180d5410c98829ee72d1d426fb7faf9e6873 ; affected 8012b866085523758780850087102421dbcce522 < ee1251621d1c7cf3155c6704542cbb358d799968 ; affected 8012b866085523758780850087102421dbcce522 < 6a37acecc7c29136235cbc446a1b89e81414344b ; affected 8012b866085523758780850087102421dbcce522 < eb412f80311fc7ab6eb3203091a3fe59a5e9fd30 ; affected 8012b866085523758780850087102421dbcce522 < 7ae9d15bdcde0f2955ae13b6a95587f9e23b2359 |
| Linux · Linux | affected 6.0 ; unaffected 0 < 6.0 ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* ; unaffected 6.12.110 ≤ 6.12.* ; unaffected 6.18.52 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |