{"schema":"threatline.record/2","record":{"id":"CVE-2026-93827","aliases":[],"summary":"virtio-fs: avoid double-free on failed queue setup","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs->vqs and fs->mq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","source_modified_at":"2026-09-25T12:43:36.887Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","status":"affected","versionType":"git"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"20ef4739b329bb09cff11dd2458795a50674658e","status":"affected","versionType":"git"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","source_modified_at":"2026-09-25T12:43:36.887Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","source_modified_at":"2026-09-25T12:43:36.887Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","source_modified_at":"2026-09-25T12:43:36.887Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"20ef4739b329bb09cff11dd2458795a50674658e","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","source_modified_at":"2026-09-25T12:43:36.887Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","basis":"first unaffected version stated in the CVE record"}],"cvss":8.4,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0014,"percentile":0.03079,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:03:05.795Z","modified_at":"2026-09-25T12:43:36.887Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93827","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T12:43:36.887Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93827","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T12:43:36.887Z","content_hash":"32b2e20adae1e6a9d5a2f93c64575cb4c0f1bb592ba63382d6db663ba87d1fe5"}}