CVE-2026-93829

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93829", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.793Z", "datePublished": "2026-09-24T16:03:11.886Z", "dateUpdated": "2026-10-30T12:36:53.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:53.159Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix races in cifsd thread creation\n\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\n\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\n\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/connect.c"], "versions": [{"version": "aaf737adb6937339494d5a7111f0433cd9676db8", "lessThan": "2376fb3348b4fa72a5158c8a63ff2489e1956541", "status": "affected", "versionType": "git"}, {"version": "aaf737adb6937339494d5a7111f0433cd9676db8", "lessThan": "cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5", "status": "affected", "versionType": "git"}, {"version": "aaf737adb6937339494d5a7111f0433cd9676db8", "lessThan": "ee8f811cbac56ffb738b3a73671a9e75b0f56e99", "status": "affected", "versionType": "git"}, {"version": "aaf737adb6937339494d5a7111f0433cd9676db8", "lessThan": "0eee1e6cddd1d9ce14da06e0238ca8d3362dec90", "status": "affected", "versionType": "git"}, {"version": "aaf737adb6937339494d5a7111f0433cd9676db8", "lessThan": "e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/connect.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2376fb3348b4fa72a5158c8a63ff2489e1956541"}, {"url": "https://git.kernel.org/stable/c/cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5"}, {"url": "https://git.kernel.org/stable/c/ee8f811cbac56ffb738b3a73671a9e75b0f56e99"}, {"url": "https://git.kernel.org/stable/c/0eee1e6cddd1d9ce14da06e0238ca8d3362dec90"}, {"url": "https://git.kernel.org/stable/c/e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d"}], "title": "smb: client: fix races in cifsd thread creation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/connect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2376fb3348b4fa72a5158c8a63ff2489e1956541", "status": "affected", "version": "aaf737adb6937339494d5a7111f0433cd9676db8", "versionType": "git"}, {"lessThan": "cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5", "status": "affected", "version": "aaf737adb6937339494d5a7111f0433cd9676db8", "versionType": "git"}, {"lessThan": "ee8f811cbac56ffb738b3a73671a9e75b0f56e99", "status": "affected", "version": "aaf737adb6937339494d5a7111f0433cd9676db8", "versionType": "git"}, {"lessThan": "0eee1e6cddd1d9ce14da06e0238ca8d3362dec90", "status": "affected", "version": "aaf737adb6937339494d5a7111f0433cd9676db8", "versionType": "git"}, {"lessThan": "e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d", "status": "affected", "version": "aaf737adb6937339494d5a7111f0433cd9676db8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/connect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"lessThan": "2.6.22", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix races in cifsd thread creation\n\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\n\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\n\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic."}], "id": "CVE-2026-93829", "lastModified": "2026-10-30T13:21:03.693", "metrics": {}, "published": "2026-09-24T17:17:16.630", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0eee1e6cddd1d9ce14da06e0238ca8d3362dec90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2376fb3348b4fa72a5158c8a63ff2489e1956541"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee8f811cbac56ffb738b3a73671a9e75b0f56e99"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: fix races in cifsd thread creation", "id": "2540472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540472"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix races in cifsd thread creation\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic.", "A flaw was found in the Linux kernel. A race condition exists in the Server Message Block (SMB) client during background worker thread creation, allowing a newly spawned thread to access connection session data before it has been completely initialized. A local user initiating an SMB connection can trigger this timing issue, causing the kernel to hang or crash and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-93829", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93829\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93829\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93829.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ee8f811cbac56ffb738b3a73671a9e75b0f56e99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0eee1e6cddd1d9ce14da06e0238ca8d3362dec90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:15:15.418341+00:00", "updated": "2026-10-01T18:45:06.991054+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}