{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-93098 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-93098 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-93098 and fix it if it is affected.\n\nWhat it is: CVE-2026-93098 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-93098 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-93098/ (Markdown: https://insights.sbomify.com/CVE-2026-93098/index.md)","id":"CVE-2026-93098","markdown":"https://insights.sbomify.com/CVE-2026-93098/index.md","name":"CVE-2026-93098","record":{"aliases":["AZL-101891","BELL-CVE-2026-93098","DEBIAN-CVE-2026-93098","GHSA-rmpv-cfqv-cmjx","UBUNTU-CVE-2026-93098"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can cause a system hang by triggering a deadlock in the Linux kernel's GLINK driver during module removal.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: glink: fix deadlock in endpoint destroy during driver detach\n\nDuring driver detach, the device core holds the device mutex throughout\nthe driver's remove callback chain.  When the rpmsg endpoint is\ndestroyed as part of that teardown, the GLINK endpoint destroy\nimplementation attempts to unregister the underlying rpmsg device.\nThat unregistration calls device_del(), which tries to re-acquire the\nsame device mutex already held higher up the stack, causing rmmod to\nhang indefinitely.\n\nThe deadlock manifests with the following call chain:\n\n[\u003c0\u003e] device_del+0x44/0x414  \u003c- tries to acquire same mutex\n[\u003c0\u003e] device_unregister+0x18/0x34\n[\u003c0\u003e] rpmsg_unregister_device+0x28/0x4c\n[\u003c0\u003e] qcom_glink_remove_rpmsg_device+0x70/0xc0\n[\u003c0\u003e] qcom_glink_destroy_ept+0x58/0xbc\n[\u003c0\u003e] rpmsg_dev_remove+0x50/0x60\n[\u003c0\u003e] device_remove+0x4c/0x80\n[\u003c0\u003e] device_release_driver_internal+0x1cc/0x228  \u003c- acquires device mutex\n[\u003c0\u003e] driver_detach+0x4c/0x98\n[\u003c0\u003e] bus_remove_driver+0x6c/0xbc\n[\u003c0\u003e] driver_unregister+0x30/0x60\n[\u003c0\u003e] unregister_rpmsg_driver+0x10/0x1c\n[\u003c0\u003e] fastrpc_exit+0x28/0x38 [fastrpc]\n[\u003c0\u003e] __arm64_sys_delete_module+0x1b8/0x294\n[\u003c0\u003e] invoke_syscall+0x48/0x10c\n[\u003c0\u003e] el0_svc_common.constprop.0+0xc0/0xe0\n[\u003c0\u003e] do_el0_svc+0x1c/0x28\n[\u003c0\u003e] el0_svc+0x34/0x108\n[\u003c0\u003e] el0t_64_sync_handler+0xa0/0xe4\n[\u003c0\u003e] el0t_64_sync+0x198/0x19c\n\nThe rpmsg device unregistration inside endpoint destroy is redundant.\nIn both contexts where endpoint destruction is triggered:\n\n- Driver detach path: the driver core already tears down the rpmsg\n  device.\n\n- Channel close path: the rpmsg device is already unregistered before\n  endpoint destruction is reached.\n\nRemove the redundant unregistration to fix the deadlock.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"rpmsg: glink: fix deadlock in endpoint destroy during driver detach","id":"CVE-2026-93098","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"fs/resctrl: Fix UAF from worker threads when domains are removed","id":"CVE-2026-93099"},"packages":[],"prev":{"headline":"cxl/mbox: Break poison list loop on an empty payload","id":"CVE-2026-93097"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can cause a system hang by triggering a deadlock in the Linux kernel's GLINK driver during module removal.","url":"https://insights.sbomify.com/CVE-2026-93098/"}