What is the CVSS score of CVE-2026-93827?

CVE-2026-93827 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-93827?

Within 24 hours, inventory all Linux systems and guests using the virtio-fs driver, identify any that can be exposed to malicious or malfunctioning virtio-fs devices (e.g., multi-tenant hosts, nested virtualization, or untrusted hypervisors), and obtain the vendor-released kernel patch for CVE-2026-93827 using the exact patched version specified in the relevant Linux distribution or kernel vendor advisory; if immediate patching is not possible for a critical system, temporarily disable or avoid attaching non-essential virtio-fs devices. Within 7 days, test and deploy the vendor patch to the highest-risk systems first, verify kernel stability after patching, and monitor for kernel panics or memory corruption events. Within 30 days, complete patching across all remaining affected systems, remove or disable virtio-fs where it is not required, and review hypervisor/device trust boundaries to ensure guests cannot be exposed to untrusted virtio-fs devices.

Linux Kernel CVE-2026-93827

EUVD-2026-86216 HIGH

2026-09-24 Linux

GHSA-898x-h72w-ghmm

Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Control malicious virtio-fs device backend
Delivery

Advertise excess request queues to guest
Exploit

Guest probe calls virtio_find_vqs() which fails
Execution

Error path frees vqs/mq_map leaving dangling pointers
Persist

kobject release double-frees
Impact

Guest kernel memory corruption/crash

Vulnerability Assessment

Exploitation Conditions	Requires the guest to be running with a virtio-fs (virtiofs) device whose backend is malicious or malfunctioning, and that device must advertise more request queues than the transport actually provides so that virtio_find_vqs() fails during setup. Exploitation is limited to VM guests using virtio-fs, is triggered only on the probe-failure cleanup path, and is controlled by the device/hypervisor side rather than by guest userspace or any remote/network actor. It is not reachable in default configurations that do not attach a hostile virtio-fs device.
Impact	Signals conflict sharply. The NVD/Linux CVSS 3.1 vector (8.4, AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) is overstated for what the patch actually fixes: a double-free of fs->vqs and fs->mq_map on the virtio-fs probe error path. The realistic outcome is memory corruption leading to a crash (kernel oops/panic), not confidentiality or integrity loss, so C:H/I:H are not justified - a more defensible vector is roughly AV:L/AC:H/PR:L/C:N/I:L/A:H (~5). Critically, the trigger is a broken/malicious virtio-fs DEVICE (host/hypervisor-side backend) advertising more request queues than the transport provides - it is NOT reachable from ordinary guest userspace or over the network, and it only fires during a probe-failure cleanup sequence, making the AC:L/PR:N metrics optimistic. There is no EPSS score, no CISA KEV listing, and no public POC. This is a legitimate memory-safety hardening fix but a low real-world priority: patch in routine kernel update cycles rather than treating it as an urgent 8.4.
Exploit ScenarioDerived	A malicious or buggy hypervisor/device backend presents a virtio-fs device to a guest that advertises more request queues than the transport actually provides. When the guest kernel probes the device, virtio_find_vqs() fails mid-setup, the error path frees fs->vqs and fs->mq_map but leaves dangling pointers, and the subsequent kobject release frees them again, corrupting kernel memory and typically crashing the guest. No public exploit is identified; the practical impact is denial of service against the guest during device probe.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A double-free in the Linux kernel's virtio-fs driver can corrupt kernel memory when a virtiofs device advertises more request queues than its transport actually provides, causing virtio_find_vqs() to fail during probe and the cleanup path to free fs->vqs and fs->mq_map twice. The flaw is reachable only from the device/hypervisor side: a guest must be running with a malicious or malfunctioning virtio-fs device, and the bug triggers solely on the probe-failure cleanup path, so it is not reachable in default configurations that do not attach a hostile virtio-fs device. Independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (local, high attack complexity, low integrity and high availability impact), which is materially lower and narrower than the published CVSS 8.4 that assumes PR:N and full integrity impact; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EUVD's 'Information Disclosure' tag conflicts with the double-free / availability-focused nature of the defect.

RemediationAI

Vendor-released patch: Linux 6.12.111, Linux 6.18.53, and the 7.2 branch as recorded by EUVD, delivered via the upstream stable commits at https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad, https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e, and https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765; upgrade guest kernels to those or later releases (or apply the corresponding vendor backport from NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-93827) and reboot, since a kernel image change is required. Because there is no guest userspace attack vector and the trigger is supplied by the hypervisor/device, the effective compensating control is configuration-side: do not attach virtiofs devices from untrusted or malfunctioning hosts, and avoid running virtiofs in mutually untrusted host-guest arrangements - the trade-off is loss of the shared filesystem feature, and if virtiofs is not needed it can be removed from the VM definition or the module blacklisted (e.g., blacklisting virtiofs / omitting the device) with the same functional trade-off. For hosts you control, ensure the virtiofs device advertises a request-queue count that matches the transport, because the failure mode only occurs on that mismatch, and monitor guest dmesg for virtio_find_vqs failures or KASAN double-free/probe-failure splats as a detection compensating control; this is reactive only and provides no protection once the cleanup path is reached.

Affected VersionsENISA

Linux patch: 6.18.53

Linux 0 <6.12.111

Linux patch: 7.2

Linux 0 <6.18.53

Linux patch: 6.12.111

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <20ef4739b329bb09cff11dd2458795a50674658e

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6af3330ec5d5fb8c06c04eb520a71cf73ea5a765

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

virtio-fs (virtiofs) is a paravirtualized shared filesystem that lets a guest kernel mount a directory exported by the host, implemented in the guest by the virtio_fs driver and its struct virtio_fs (which holds the virtqueue array fs->vqs and the queue map fs->mq_map). During virtio_fs_setup_vqs(), the driver allocates fs->vqs and fs->mq_map and then calls virtio_find_vqs(); if that call fails - for example when a broken device advertises more request queues (num_request_queues) than the transport actually provides and the extra queue cannot be set up - the error path kfree()s both pointers and returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, invoking virtio_fs_ktype_release(), which frees fs->vqs and fs->mq_map again, leaving dangling pointers in struct virtio_fs and producing a double-free during probe-failure cleanup. The CWE field is unassigned in the source data, but the defect class is a classic double-free (CWE-415) with an associated dangling-pointer / use-after-free condition (CWE-416); the fix simply sets fs->vqs and fs->mq_map to NULL immediately after kfree() in the error path so the later kobject release performs harmless kfree(NULL). Because the double-free occurs in kernel context during probe teardown, impact is kernel heap corruption (assessed as no confidentiality loss, low integrity impact, high availability impact) rather than remote code execution; the trigger is controlled entirely by the hypervisor/device side and is not reachable from guest userspace.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 5.3 MEDIUM

Trigger requires a malicious virtio-fs device and a specific probe-failure race (AC:H), reachable only in a configured guest (PR:L, AV:L); impact is a crash (A:H), not disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE 6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 25, 2026 - 05:23 NVD

8.4 (HIGH)

Patch available

Sep 24, 2026 - 17:03 EUVD

CVE Published

Sep 24, 2026 - 16:03 cve.org

HIGH 8.4

CVE Published

Sep 24, 2026 - 16:03 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virtio-fs: avoid double-free on failed queue setup

virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and returns an error to virtio_fs_probe().

virtio_fs_probe() then drops the last kobject reference, and virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves dangling pointers in struct virtio_fs and can trigger a double-free during probe failure cleanup.

Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the virtio_fs_setup_vqs() error path so that the later kobject release sees an uninitialized state and kfree(NULL) becomes harmless.

This can be reproduced when a broken virtio-fs device advertises more request queues than the transport actually provides. In that case virtio_find_vqs() fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.

Executive ViewAI

Why It Matters

The Linux kernel's virtio-fs driver contains a double-free flaw (CVE-2026-93827) that can corrupt kernel memory and cause availability loss when a guest is exposed to a malicious or malfunctioning virtio-fs device. This is not reachable in default configurations and requires a hostile or defective device/hypervisor, so organizational exposure is concentrated in virtualized environments that attach non-default virtio-fs devices or run under untrusted hypervisor control. A vendor patch is available, and no public exploit identified at time of analysis.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Ubiquitous

Linux kernel is ubiquitous, though virtio-fs driver active only in VM guests

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93827 REF https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e REF https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad REF https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back