Strix
74.5K

CVE-2026-93288

HIGHCVSS 7.8/10EPSS 0.13%

Last modified

CVE-2026-93288 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()." Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. EPSS estimates a 0.13% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()." Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.13%

2.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < ba2e246aa294f9acd86194ea87fb6834ed0a37ac; >= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < 5570d6c8b320dbcc602617ee08c27ce752fed65a; >= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < 3b9aa62d78ce80de47af2db472ff452398755213; >= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < f4461654374576e9d5d0245fd534c46ad8509051; >= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < dc20050b6b12ca58066715d088e1a537535d938d; >= c83fa19603bdaeef17b815713dbbe3230c8a34ee, < 33d1469b0124cc0baaea7a2032123b77a81e0940
LinuxLinux4.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-93288?
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()." Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.
How severe is CVE-2026-93288?
CVE-2026-93288 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.
How do I fix CVE-2026-93288?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-93288?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST