Skip to main content

Linux Kernel CVE-2026-93262

| EUVDEUVD-2026-86134 HIGH
2026-09-24 Linux GHSA-238f-5wx4-vrgf
Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privileged shell
  2. Delivery
    Identify MD RAID5 array with PPL enabled
  3. Exploit
    Drive I/O to trigger ppl_do_flush() flush loop
  4. Execution
    Loop touches freed io after ppl_io_unit_finished()
  5. Persist
    Groom kernel slab to control freed object
  6. Impact
    Corrupt kernel memory / escalate to root

Vulnerability Assessment

Exploitation Conditions

Requires local access with low privileges (PR:L, AV:L) on a Linux host that uses the MD RAID5 driver with the Partial Parity Log (PPL) feature enabled - the vulnerable ppl_do_flush() path in md/raid5-ppl only executes when a RAID5 array is configured with PPL journaling. Systems without MD RAID5, or RAID5 arrays that do not use PPL, do not reach this code and are not exploitable. Exploitation further depends on winning the use-after-free window and successfully grooming the kernel slab to convert the freed io_unit dereference into a controllable corruption; there is no remote or unauthenticated exploitation path.
Impact

This is a genuine local privilege-escalation-class kernel memory-corruption bug, but its real-world priority is moderate rather than urgent. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 HIGH) correctly reflects a use-after-free (CWE-416, though CWE is listed N/A in the input) that a local, already-authenticated user could leverage for C:H/I:H/A:H impact - the classic kernel-UAF-to-LPE profile. Countervailing signals lower the practical urgency: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so this is no public exploit identified at time of analysis, not active exploitation. Critically, the flaw lives in md/raid5-ppl, the Partial Parity Log write-journaling path for MD RAID5 arrays; exploitation is gated on a system actually running a RAID5 array with PPL enabled, which is a minority of Linux deployments. The vector is also purely local (AV:L) with no remote reachability. Net: a real fix-worthy kernel bug, but not a drop-everything item given local-only access, low-privilege prerequisite plus a non-default subsystem, and absence of any exploitation or POC signal.
Exploit ScenarioDerived

A local low-privileged user on a host whose storage is backed by an MD RAID5 array with the PPL write-journal enabled triggers I/O flush activity against that array, causing ppl_do_flush() to keep iterating and dereference an io_unit structure that ppl_io_unit_finished() has already freed. By grooming the freed kernel slab, the attacker turns the resulting use-after-free into kernel memory corruption and potential privilege escalation. No public exploit code is referenced for this issue.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A use-after-free in the Linux kernel's MD RAID5 Partial Parity Log (PPL) implementation lets a local attacker holding low privileges on a host that runs a PPL-enabled RAID5 array corrupt kernel memory, with the assessed impact being full loss of confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a plausible path to kernel code execution or privilege escalation to root. The bug lives in ppl_do_flush(), whose loop keeps iterating over io->pending_flushes after ppl_io_unit_finished() has already freed the io unit; the fix is a single break statement that terminates the loop once the unit is released. Vendor patches are available across the affected stable branches, and no public exploit code was identified at time of analysis; exploitation is gated on reaching the PPL flush path at all (RAID5 with PPL journaling) and on winning the use-after-free window, so practical priority is moderate rather than urgent.

RemediationAI

Vendor-released patch: update to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 or 7.3-rc1 (or the equivalent backport shipped by your distribution), all of which contain the loop-termination fix in ppl_do_flush() as detailed in the stable-tree commits linked from the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-93262; patching is the only complete fix because the flaw is in the flush path itself. If immediate upgrade is not possible, the practical compensating control is to stop relying on PPL for write-hole protection: unmount and reassemble affected arrays without PPL (mdadm --create/--grow without the ppl layout, or replace PPL journaling with a dedicated write-journal/write-mostly or bitmap configuration), which removes the vulnerable code path entirely but costs the PPL metadata that guarantees clean reassembly after an unclean shutdown and may require a full resync or reshape. Restricting local login and container/mount privileges on hosts running PPL-enabled RAID5 arrays limits who can trigger the flush path but does not eliminate the bug. Note that no public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so remediation can be scheduled with normal kernel-maintenance urgency rather than treated as an emergency, with preference given to hosts where untrusted local users share a kernel with production RAID5 storage.

Affected VersionsENISA

Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <8914c3d40870f16429a326e97e4016bedc6ede4c
Linux patch: 6.1.188
Linux 4.16
Linux patch: 7.2.6
Linux patch: 5.10.270
Linux patch: 6.12.110
Linux patch: 0
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <b5123bf667ac29ddd8106f9ca7cc01316513ae66
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <371f7a1b392edc8b7cf449cc7713179b588f2d0e
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <e77c80670f2c2bf491da9b173931e1da4677c23a
Linux patch: 5.15.221
Linux patch: 7.3-rc1
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <455b56209f9615c3902dcc398dd867abb5ade3ab
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <fcf21df7d3c50c8ebeb0757df5d21b02dcae4218
Linux patch: 6.6.157
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <e7505842f1329ece90cb9ea0db87772aeca44052
Linux patch: 6.18.52
Linux 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <cf01f9413565e86673baf927291a088b6975692b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code is the Partial Parity Log (PPL) write-hole protection feature of the Linux MD RAID5 driver, introduced in the 4.16 kernel series in drivers/md/raid5-ppl.c, which journals partial parity for RAID5 arrays (the '--ppl' option in mdadm) so that a dirty shutdown leaves a recoverable array. During normal operation each PPL write is tracked by an io_unit structure; ppl_do_flush() walks a list of these units and calls ppl_io_unit_finished() on each one, which releases and frees the io_unit. Because the loop was written to continue iterating instead of stopping after the unit was freed, the next loop step dereferences the already-freed io (touching io->pending_flushes), producing a classic use-after-free in the CWE-416 class (the submission carries no assigned CWE, but the root cause is unambiguous from the description). The supplied CPE data (cpe:2.3:a:linux:linux) confirms the Linux kernel itself as the vulnerable component, with affected state reaching back to the 4.16 introduction of PPL and fixed in the stable trees and mainline, so any distribution kernel older than its corresponding backport is exposed. Slab reuse after the free is what turns the stale dereference into controllable memory corruption; the code path is only reachable when a RAID5 array is actively using PPL, which bounds the attack surface to local, low-privileged users of such a system.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local-only kernel bug reachable by a low-privileged user operating an MD RAID5+PPL array (AV:L/PR:L); a UAF yields full memory-corruption C/I/A:H within the same (kernel) scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.8 (HIGH)
Patch available
Sep 24, 2026 - 17:18 EUVD
CVE Published
Sep 24, 2026 - 15:52 cve.org
HIGH 7.8
CVE Published
Sep 24, 2026 - 15:52 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-ppl: fix use-after-free in ppl_do_flush()

The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free.

Add a break statement to stop the loop once io is freed.

Executive ViewAI

Why It Matters

A high-severity local privilege escalation vulnerability in the Linux kernel's RAID5 Partial Parity Log (PPL) implementation could allow an authenticated attacker with low privileges to gain root-level control of affected servers, threatening data confidentiality, integrity, and availability. Organizations running Linux hosts with PPL-enabled RAID5 arrays are at risk, though exploitation requires local access and specific conditions. No public exploit identified at time of analysis; patch available per vendor advisory and should be prioritized to prevent potential system compromise.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a huge fraction of servers, though RAID5-PPL path is niche
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93262 ADVISORY https://vuldb.com/vuln/409712 REF https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e REF https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab REF https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c REF https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66 REF https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b REF https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052 REF https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a REF https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy