All vulnerabilities
CVE-2026-93261

Linux: locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2Also 5c3bff6cf26e6a54fbf8b893a879c32824d2d50d, 9be10f49dfc2e4b472b3a5f346483b67374774b8 and 1 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2LinuxCVE List
  • 5c3bff6cf26e6a54fbf8b893a879c32824d2d50dLinuxCVE List
  • 9be10f49dfc2e4b472b3a5f346483b67374774b8LinuxCVE List
  • 7577e00b9ab506202b9f1a33de3cc8cc6413a4dbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

register_lock_class() can return NULL when the lock class pool is exhausted, graph_lock() fails, or key validation fails. However, __lock_set_class() uses the return value directly in pointer arithmetic without a NULL check:

class = register_lock_class(lock, subclass, 0); hlock->class_idx = class - lock_classes;

If class is NULL, this computes a wild offset that corrupts hlock->class_idx. The subsequent reacquire_held_locks() call will invoke hlock_class() with this corrupted index, leading to a NULL or out-of-bounds pointer dereference.

Add the missing NULL check, consistent with how __lock_acquire() already handles this case at the same call site.

Text from CVE List

Affected versions 18

  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before f6093ff67ea6e347574819ed23e96e0f82a25ffcCVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before 59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2CVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before f56e54fd24f05e9de528fcb77f6084f80c8066ceCVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before 5c3bff6cf26e6a54fbf8b893a879c32824d2d50dCVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before b2113dcd8238bf00ce37a34e67b29cf31d32a545CVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before e7c69c6695d84220847cca62a45e879e71e79e9dCVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before 9be10f49dfc2e4b472b3a5f346483b67374774b8CVE List
  • Linuxaffected: 64aa348edc617dea17bbd01ddee4e47886d5ec8c before 7577e00b9ab506202b9f1a33de3cc8cc6413a4dbCVE List
  • Linuxaffected: 2.6.27CVE List
  • Linuxunaffected: all versions before 2.6.27CVE List
  • Linuxunaffected: 5.10.270 through 5.10.*CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8