CVE-2026-93279 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
A use-after-free vulnerability in the Linux kernel Octeon driver allows local attackers to cause denial of service or potentially escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93279?
CVE-2026-93279 is an use after free vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in the queue which might run after the cvm_oct_remove() frees net_device structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it iterates cvm_oct_device[] which is an array of netdevice pointers. Add tasklet_kill() after free_irq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.
Which versions are affected by CVE-2026-93279?
How do I fix CVE-2026-93279?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93279 being exploited?
There is no known exploitation of CVE-2026-93279 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93279, DEBIAN-CVE-2026-93279, GHSA-j68w-r43c-3g43, UBUNTU-CVE-2026-93279.