{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93278", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.098Z", "datePublished": "2026-09-24T15:52:20.416Z", "dateUpdated": "2026-09-24T15:52:20.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-24T15:52:20.416Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdown\n\ncvm_oct_rx_shutdown calls free_irq and netif_napi_del without\ndisabling the napi instance first. As the free_irq only waits\nfor completion of hard interrupt handlers, the napi poll\nfunction could still be active. If cvm_oct_remove proceeds to\nfree the plat structure (which holds the NAPI instances), the\nactive poll function will access freed memory, resulting in a\nuse-after-free crash."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/octeon/ethernet-rx.c"], "versions": [{"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "158389d7af04bbf0664d91c2ce31fcc9eeace1eb", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "c124049c3a7006fd6caf629139a5722610bbffb4", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "98f9036b2254c928cb44da0c77dba38f66f7d8f1", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "b38fbd68cc36b4f478a1e3cfc169b8616ae1337d", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "89f9f433271fad9351de6a3c713b45b2cfb23e4a", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "b2243ffaac14cc3639b5b32a371aac37f96ee554", "status": "affected", "versionType": "git"}, {"version": "3368c784bcf77124aaf39372e627016c36bd4472", "lessThan": "c0a9a8586a63fda49e61a6b83360feac2a60d898", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/octeon/ethernet-rx.c"], "versions": [{"version": "2.6.34", "status": "affected"}, {"version": "0", "lessThan": "2.6.34", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/158389d7af04bbf0664d91c2ce31fcc9eeace1eb"}, {"url": "https://git.kernel.org/stable/c/c124049c3a7006fd6caf629139a5722610bbffb4"}, {"url": "https://git.kernel.org/stable/c/98f9036b2254c928cb44da0c77dba38f66f7d8f1"}, {"url": "https://git.kernel.org/stable/c/b38fbd68cc36b4f478a1e3cfc169b8616ae1337d"}, {"url": "https://git.kernel.org/stable/c/89f9f433271fad9351de6a3c713b45b2cfb23e4a"}, {"url": "https://git.kernel.org/stable/c/b2243ffaac14cc3639b5b32a371aac37f96ee554"}, {"url": "https://git.kernel.org/stable/c/c0a9a8586a63fda49e61a6b83360feac2a60d898"}], "title": "staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/octeon/ethernet-rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "158389d7af04bbf0664d91c2ce31fcc9eeace1eb", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "c124049c3a7006fd6caf629139a5722610bbffb4", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "98f9036b2254c928cb44da0c77dba38f66f7d8f1", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "b38fbd68cc36b4f478a1e3cfc169b8616ae1337d", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "89f9f433271fad9351de6a3c713b45b2cfb23e4a", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "b2243ffaac14cc3639b5b32a371aac37f96ee554", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}, {"lessThan": "c0a9a8586a63fda49e61a6b83360feac2a60d898", "status": "affected", "version": "3368c784bcf77124aaf39372e627016c36bd4472", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/octeon/ethernet-rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.34"}, {"lessThan": "2.6.34", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdown\n\ncvm_oct_rx_shutdown calls free_irq and netif_napi_del without\ndisabling the napi instance first. As the free_irq only waits\nfor completion of hard interrupt handlers, the napi poll\nfunction could still be active. If cvm_oct_remove proceeds to\nfree the plat structure (which holds the NAPI instances), the\nactive poll function will access freed memory, resulting in a\nuse-after-free crash."}], "id": "CVE-2026-93278", "lastModified": "2026-09-24T16:17:25.017", "metrics": {}, "published": "2026-09-24T16:17:25.017", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/158389d7af04bbf0664d91c2ce31fcc9eeace1eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89f9f433271fad9351de6a3c713b45b2cfb23e4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/98f9036b2254c928cb44da0c77dba38f66f7d8f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2243ffaac14cc3639b5b32a371aac37f96ee554"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b38fbd68cc36b4f478a1e3cfc169b8616ae1337d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0a9a8586a63fda49e61a6b83360feac2a60d898"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c124049c3a7006fd6caf629139a5722610bbffb4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown", "id": "2540312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540312"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdown\ncvm_oct_rx_shutdown calls free_irq and netif_napi_del without\ndisabling the napi instance first. As the free_irq only waits\nfor completion of hard interrupt handlers, the napi poll\nfunction could still be active. If cvm_oct_remove proceeds to\nfree the plat structure (which holds the NAPI instances), the\nactive poll function will access freed memory, resulting in a\nuse-after-free crash.", "A flaw was found in the Linux kernel's Octeon network driver. During interface shutdown, the driver deletes the packet polling mechanism without properly disabling it first, allowing active polling routines to continue running after interrupt handlers are released. A local attacker could exploit this race condition during device removal or shutdown to trigger a use-after-free error when memory is freed, resulting in a system crash and Denial of Service (DoS)."], "name": "CVE-2026-93278", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93278\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93278\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93278.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,158389d7af04bbf0664d91c2ce31fcc9eeace1eb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,c124049c3a7006fd6caf629139a5722610bbffb4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,98f9036b2254c928cb44da0c77dba38f66f7d8f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,b38fbd68cc36b4f478a1e3cfc169b8616ae1337d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,89f9f433271fad9351de6a3c713b45b2cfb23e4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,b2243ffaac14cc3639b5b32a371aac37f96ee554)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3368c784bcf77124aaf39372e627016c36bd4472,c0a9a8586a63fda49e61a6b83360feac2a60d898)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.34"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.34)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.221,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T05:30:18.102755+00:00", "title": "Use\u2011After\u2011Free in Octeon Driver Due to Missing NAPI Disable During Shutdown", "updated": "2026-09-25T08:45:17.344341+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-415"]}