{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97941 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97941 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97941 and fix it if it is affected.\n\nWhat it is: CVE-2026-97941 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97941 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97941/ (Markdown: https://insights.sbomify.com/CVE-2026-97941/index.md)","id":"CVE-2026-97941","markdown":"https://insights.sbomify.com/CVE-2026-97941/index.md","name":"CVE-2026-97941","record":{"aliases":["DEBIAN-CVE-2026-97941","GHSA-jvph-rmf4-fgm6","UBUNTU-CVE-2026-97941"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel slab allocator can cause list corruption and kernel panics, leading to denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race\n\nCommit ba7425312607 (\"mm, slab: add an optimistic\n__slab_try_return_freelist()\") incorrectly assumed that nobody has freed\nan object to the slab as long as slab-\u003efreelist is NULL and cmpxchg\nsucceeds.\n\nHowever, as reported by Hyunwoo Kim [1], other CPUs might have freed\nan object to the slab, insert the slab to the partial list, then\nallocated an object from the slab, and be in the middle of removing\nthe slab from the list under n-\u003elist_lock.\n\nSince __refill_objects_node() puts the slab back on pc.slabs\noutside n-\u003elist_lock, it might insert the slab into that list while\nthe slab is concurrently being removed from n-\u003epartial.\nThis led to a list corruption [1]:\n\n  list_add corruption. next-\u003eprev should be prev\n  (ffff888100000248), but was dead000000000122.\n  (next=ffffea000416e410).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted\n  7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)\n  RIP: 0010:__list_add_valid_or_report+0x80/0xd0\n  ...\n  Call Trace:\n   alloc_from_new_slab+0x183/0x300\n   ___slab_alloc+0x31c/0x890\n   __kmalloc_noprof+0x3d4/0x800\n   lsm_blob_alloc+0x2d/0x50\n   security_msg_msg_alloc+0x26/0x90\n   load_msg+0x1aa/0x210\n   do_msgsnd+0x91/0x800\n   do_syscall_64+0x109/0x5d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis is a classic ABA problem where cmpxchg succeeds but the state has\nchanged since __refill_objects_node() took the freelist from the slab.\n\nAs Vlastimil Babka mentioned [2], it should be rare to return more than\none slab (due to the racy read of slab-\u003ecounters in\nget_partial_node_bulk()). Therefore, instead of introducing additional\ncomplexity, acquire and release n-\u003elist_lock twice in the worst case.\n\nReturn the slab directly to the partial list and hold n-\u003elist_lock\nacross the cmpxchg and add_partial(). This is similar to the initial\nversion of commit ba7425312607 [3]. This is enough to avoid the race as\nthe list manipulation is serialized by n-\u003elist_lock. While at it,\nbring back unlikely() hint now that the condition is unlikely.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-18","github_poc":1,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-18T23:33:26Z","kind":"github_poc","ref":"https://github.com/ylh440104/InfinityCore-Android-CVE-2026-97941","stars":2,"title":"Android/ARM64 port"}],"tier":"poc_unverified"},"has_fix":true,"headline":"mm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race","id":"CVE-2026-97941","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"x86/alternatives: Exclude text poking against change_page_attr()","id":"CVE-2026-97942"},"packages":[],"prev":{"headline":"ipv6: fix fib6 walker UAF on seq stop","id":"CVE-2026-97940"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel slab allocator can cause list corruption and kernel panics, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-97941/"}