CVE-2026-93112

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-93112

Key Details

CVE	CVE-2026-93112
CVSS Score / Version	7.1 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

bpf: Require a BPF cpumask for bpf_cpumask_populate()

bpf_cpumask_populate() writes to its destination with bitmap_copy(), but

the destination is typed as struct cpumask *. That allows the verifier to

accept borrowed cpumask pointers returned by read-only kfuncs, such as

scx_bpf_get_online_cpumask(), as a writable destination.

Make the destination a struct bpf_cpumask * so populate follows the same

ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue

to accept const struct cpumask * inputs. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-93112
CVE	https://www.cve.org/CVERecord?id=CVE-2026-93112

Source

Reference

NVD

CVE