CVE-2026-97941

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

Commit ba7425312607 ("mm, slab: add an optimistic

__slab_try_return_freelist()") incorrectly assumed that nobody has freed

an object to the slab as long as slab->freelist is NULL and cmpxchg

succeeds.

However, as reported by Hyunwoo Kim [1], other CPUs might have freed

an object to the slab, insert the slab to the partial list, then

allocated an object from the slab, and be in the middle of removing

the slab from the list under n->list_lock.

Since __refill_objects_node() puts the slab back on pc.slabs

outside n->list_lock, it might insert the slab into that list while

the slab is concurrently being removed from n->partial.

This led to a list corruption [1]:

list_add corruption. next->prev should be prev

(ffff888100000248), but was dead000000000122.

(next=ffffea000416e410).

kernel BUG at lib/list_debug.c:29!

Oops: invalid opcode: 000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References