Riskcovery

CVE-2026-93134

printk: Fix possible console use-after-free

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

printk: Fix possible console use-after-free

When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage.

Sashiko pointed out that console_flush_one_record() was not doing this.

In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c158834b223fbfab3a14855ac203b8d9cddbbefd to before f0104a7b730de32eefb3d4a27279592b5504ad59Affected
  • c158834b223fbfab3a14855ac203b8d9cddbbefd to before fbf9bb81b21537ede387a31cc586f1d2ce66a74eAffected
  • c158834b223fbfab3a14855ac203b8d9cddbbefd to before 8f194dee0c0d1223255bae1429e1939882f540fcAffected
  • c158834b223fbfab3a14855ac203b8d9cddbbefd to before 36630cafbeede0b64c370edb2f7b4094327ee1e0Affected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.