Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93262

md/raid5-ppl: fix use-after-free in ppl_do_flush()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after-free. Add a break statement to stop the loop once io is freed.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in cf01f9413565e86673baf927291a088b6975692b; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in e7505842f1329ece90cb9ea0db87772aeca44052; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in b5123bf667ac29ddd8106f9ca7cc01316513ae66; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in e77c80670f2c2bf491da9b173931e1da4677c23a; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in 8914c3d40870f16429a326e97e4016bedc6ede4c; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in 455b56209f9615c3902dcc398dd867abb5ade3ab; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in fcf21df7d3c50c8ebeb0757df5d21b02dcae4218; From 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 · fixed in 371f7a1b392edc8b7cf449cc7713179b588f2d0e

  • Linux Linux

    4.16

  • KernelLinux

    From 4.16.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8

git.kernel.org