{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-93250 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-93250 is a high-severity use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-93250 and fix it if it is affected.\n\nWhat it is: CVE-2026-93250 is a high-severity use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-93250 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-93250/ (Markdown: https://insights.sbomify.com/CVE-2026-93250/index.md)","id":"CVE-2026-93250","markdown":"https://insights.sbomify.com/CVE-2026-93250/index.md","name":"CVE-2026-93250","record":{"aliases":["BELL-CVE-2026-93250","DEBIAN-CVE-2026-93250","GHSA-xj6p-hw9r-5g4r","UBUNTU-CVE-2026-93250"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel VXLAN","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel VXLAN module allows local attackers to execute arbitrary code or escalate privileges via crafted netlink messages.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_flush()\n\nvxlan_mdb_flush() iterates over the MDB entries using\nhlist_for_each_entry_safe(), which only tolerates the removal of the\ncurrent entry. Contrary to the comment above the loop, the removal of an\nentry can trigger the removal of another entry.\n\nFlushing the remotes of a (*, G) entry also removes the (S, G) entries\nthat were created for its source list, once they are left without\nremotes:\n\nvxlan_mdb_remotes_flush()\n-\u003e vxlan_mdb_remote_del()\n   -\u003e vxlan_mdb_remote_srcs_del()\n      -\u003e vxlan_mdb_remote_src_del()\n         -\u003e vxlan_mdb_remote_src_fwd_del()\n            -\u003e __vxlan_mdb_del()\n               -\u003e vxlan_mdb_entry_put()\n\nSuch an entry can be located after the (*, G) entry in the list, as\nvxlan_mdb_entry_get() returns an existing entry without moving it to the\nhead of the list. This order is obtained by adding the (S, G) entry\nbefore the (*, G) entry, the latter with NLM_F_REPLACE, as the addition\nof the source otherwise fails with -EEXIST. The (S, G) entry is then the\nentry saved by hlist_for_each_entry_safe() and it is freed while the\n(*, G) entry is processed. The next iteration calls hlist_del() on it\nagain, writing LIST_POISON1 to LIST_POISON2 [1].\n\nBesides device deletion, the flush is also reachable from RTM_DELMDB\nwith NLM_F_BULK.\n\nFix by re-reading the next entry after the remotes were flushed. The\ncurrent entry cannot be removed by this flush, as source lists can only\nbe configured on (*, G) entries and the removed entries are (S, G)\nentries. It is therefore still linked and its next pointer reflects the\nremovals.\n\n[1]\nBUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588\nWrite of size 8 at addr dead000000000122 by task ip/327\n\nCPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT\nCall trace:\n vxlan_mdb_entry_put.part.0+0x328/0x588\n vxlan_mdb_flush+0x1d8/0x25c\n vxlan_mdb_fini+0x8c/0x100\n vxlan_uninit+0x1c/0x7c\n unregister_netdevice_many_notify+0x954/0xd4c\n rtnl_dellink+0x210/0x530\n rtnetlink_rcv_msg+0x434/0x4d0\n netlink_rcv_skb+0xc4/0x204\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x548\n netlink_sendmsg+0x29c/0x560\n ____sys_sendmsg+0x390/0x3ec\n ___sys_sendmsg+0x114/0x188\n __sys_sendmsg+0xf0/0x178\n __arm64_sys_sendmsg+0x48/0x60\n invoke_syscall.constprop.0+0x58/0x180\n el0_svc_common.constprop.0+0x74/0x140\n do_el0_svc+0x30/0x40\n el0_svc+0x38/0x98\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()","id":"CVE-2026-93250","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ACPI: bus: Introduce acpi_bus_get_primary_device()","id":"CVE-2026-93251"},"packages":[],"prev":{"headline":"spi: amlogic-spisg: Make sure clk_init_data is fully initialized","id":"CVE-2026-93249"},"products":["Linux"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel VXLAN module allows local attackers to execute arbitrary code or escalate privileges via crafted netlink messages.","url":"https://insights.sbomify.com/CVE-2026-93250/"}