CVE-2026-93253 sched/isolation: Defer freeing of cpumask memblock memory to initcall
A use-after-free vulnerability in the Linux kernel scheduler isolation code can cause a kernel warning or crash during boot when specific parameters are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93253?
CVE-2026-93253 is an use after free vulnerability in Linux, published on 24 Sep 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sched/isolation: Defer freeing of cpumask memblock memory to initcall
When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock: warn when freeing reserved memory before memory map is initialized"), the following warning was hit when there was a "nohz_full" kernel boot parameter.
Cannot free reserved memory because of deferred initialization of the memory map WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0 : Call Trace: <TASK> memblock_phys_free+0xcb/0x100 housekeeping_init+0x14c/0x170 start_kernel+0x207/0x450 x86_64_start_reservations+0x24/0x30 x86_64_start_kernel+0xda/0xe0 common_startup_64+0x13e/0x141 </TASK>
IOW, we shouldn't free memblock allocated memory so early in the boot process when memory map isn't fully initialized in deferred_init_memmap().
Fix it by saving the housekeeping cpumask memblock memory to be freed into a llist free list in housekeeping_init() and add a new housekeeping_late_init() helper to defer the actual freeing of memblock memory to when initcall's are being processed. The cpumask memblock memory is treated as a llist_node with the size of a "long" type which is also smallest cpumask size that can be allocated.
The non-atomic version of the llist APIs are used as there is no contention.
This commit depends on the presence of commit 7c2eee9c1367 ("memblock: don't touch memblock arrays when memblock_free() is called late") to prevent a KASAN UAF bug report [1].
[1] https://lore.kernel.org/lkml/[email protected]/
Which versions are affected by CVE-2026-93253?
How do I fix CVE-2026-93253?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93253 being exploited?
There is no known exploitation of CVE-2026-93253 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93253, GHSA-w946-9g6f-2799, UBUNTU-CVE-2026-93253.