CVE-2026-93134 printk: Fix possible console use-after-free
A use-after-free in the Linux kernel console handling allows local attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93134?
CVE-2026-93134 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
printk: Fix possible console use-after-free
When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage.
Sashiko pointed out that console_flush_one_record() was not doing this.
In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check.
Which versions are affected by CVE-2026-93134?
How do I fix CVE-2026-93134?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93134 being exploited?
There is no known exploitation of CVE-2026-93134 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93134, DEBIAN-CVE-2026-93134, GHSA-hf69-jx63-p85x, UBUNTU-CVE-2026-93134.