vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-93262

md/raid5-ppl: fix use-after-free in ppl_do_flush()

HIGH
7.8
CVSS Score
Published: September 24, 2026 at 03:52 PM UTC
Updated: October 19, 2026 at 10:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free. Add a break statement to stop the loop once io is freed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
1532d9e87e8b2377f12929f9e40724d5fbe6ecc54.16
Vendor states this is fixed in 371f7a1b392edc8b7cf449cc7713179b588f2d0e (fixed)
Vendor states this is fixed in 455b56209f9615c3902dcc398dd867abb5ade3ab (fixed)
Vendor states this is fixed in 8914c3d40870f16429a326e97e4016bedc6ede4c (fixed)
Vendor states this is fixed in b5123bf667ac29ddd8106f9ca7cc01316513ae66 (fixed)
Vendor states this is fixed in cf01f9413565e86673baf927291a088b6975692b (fixed)
Vendor states this is fixed in e7505842f1329ece90cb9ea0db87772aeca44052 (fixed)
Vendor states this is fixed in e77c80670f2c2bf491da9b173931e1da4677c23a (fixed)
Vendor states this is fixed in fcf21df7d3c50c8ebeb0757df5d21b02dcae4218 (fixed)
Vendor states this is fixed in 4.16 (unaffected)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.52 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.6 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b
Source: cverecord
https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052
Source: cverecord
https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66
Source: cverecord
https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a
Source: cverecord
https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c
Source: cverecord
https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab
Source: cverecord
https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218
Source: cverecord
https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card