# CVE-2026-93253: sched/isolation: Defer freeing of cpumask memblock memory to initcall

> A use-after-free vulnerability in the Linux kernel scheduler isolation code can cause a kernel warning or crash during boot when specific parameters are used.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-93253, GHSA-w946-9g6f-2799, UBUNTU-CVE-2026-93253

## What is CVE-2026-93253?

CVE-2026-93253 is an use after free vulnerability in Linux, published on 24 Sep 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

sched/isolation: Defer freeing of cpumask memblock memory to initcall

When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
warn when freeing reserved memory before memory map is initialized"),
the following warning was hit when there was a "nohz_full" kernel boot
parameter.

  Cannot free reserved memory because of deferred initialization of the memory map
  WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0
    :
  Call Trace:
   <TASK>
   memblock_phys_free+0xcb/0x100
   housekeeping_init+0x14c/0x170
   start_kernel+0x207/0x450
   x86_64_start_reservations+0x24/0x30
   x86_64_start_kernel+0xda/0xe0
   common_startup_64+0x13e/0x141
   </TASK>

IOW, we shouldn't free memblock allocated memory so early
in the boot process when memory map isn't fully initialized in
deferred_init_memmap().

Fix it by saving the housekeeping cpumask memblock memory to be
freed into a llist free list in housekeeping_init() and add a new
housekeeping_late_init() helper to defer the actual freeing of memblock
memory to when initcall's are being processed. The cpumask memblock
memory is treated as a llist_node with the size of a "long" type which
is also smallest cpumask size that can be allocated.

The non-atomic version of the llist APIs are used as there is no
contention.

This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
don't touch memblock arrays when memblock_free() is called late")
to prevent a KASAN UAF bug report [1].

 [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/

## Which versions are affected by CVE-2026-93253?


## How do I fix CVE-2026-93253?

Apply the vendor's patch.

## Is CVE-2026-93253 being exploited?

There is no known exploitation of CVE-2026-93253 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-93253 and fix it if it is affected.

What it is: CVE-2026-93253 is an use after free vulnerability in Linux, published on 24 Sep 2026. 
Exploitation: There is no known exploitation of CVE-2026-93253 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-93253/ (Markdown: https://insights.sbomify.com/CVE-2026-93253/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-93253
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93253
- OSV: https://osv.dev/vulnerability/CVE-2026-93253

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-93253/
Summaries are generated and may contain mistakes; the official description above is the record.