CVE-2026-93288

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93288
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93288.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-93288
Downstream
Related
Published
2026-09-24T16:02:12Z
Modified
2026-10-13T11:41:54Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()."

Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93288.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c83fa19603bdaeef17b815713dbbe3230c8a34ee
Fixed
ba2e246aa294f9acd86194ea87fb6834ed0a37ac
Fixed
5570d6c8b320dbcc602617ee08c27ce752fed65a
Fixed
3b9aa62d78ce80de47af2db472ff452398755213
Fixed
f4461654374576e9d5d0245fd534c46ad8509051
Fixed
dc20050b6b12ca58066715d088e1a537535d938d
Fixed
33d1469b0124cc0baaea7a2032123b77a81e0940

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93288.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.12.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93288.json"