CVE-2026-93208

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kasan: fix cache shrink race with CPU hotplug

kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on

all online CPUs. Each callback moves objects belonging to the cache from

cpu_quarantine to the CPU's shrink_qlist, where they can later be freed

from task context.

kmem_cache_destroy() invokes the quarantine removal path while holding

cpus_read_lock(), but kmem_cache_shrink() does not. The latter can

therefore race with CPU offlining as follows:

kmem_cache_shrink() CPU hotplug

------------------- -----------

on_each_cpu()

CPU1 moves objects to

CPU1's shrink_qlist

on_each_cpu() returns

CPU1 goes offline

kasan_cpu_offline()

drains cpu_quarantine

leaves shrink_qlist untouched

for_each_online_cpu()

skips CPU1

The obje

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References