{
  "cveId": "CVE-2026-93208",
  "url": "https://patchblox.com/security/cve/CVE-2026-93208",
  "summary": "CVE-2026-93208 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-93208, released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kasan: fix cache shrink race with CPU hotplug",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  kasan: fix cache shrink race with CPU hotplug  kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on all online CPUs.  Each callback moves objects belonging to the cache from cpu_quarantine to the CPU\u0027s shrink_qlist, where they can later be freed from task context.  kmem_cache_destroy() invokes the quarantine removal path while holding cpus_read_lock(), but kmem_cache_shrink() does not.  The latter can therefore race with CPU offlining as follows:    kmem_cache_shrink()             CPU hotplug   -------------------             -----------   on_each_cpu()     CPU1 moves objects to     CPU1\u0027s shrink_qlist   on_each_cpu() returns                                   CPU1 goes offline                                   kasan_cpu_offline()                                     drains cpu_quarantine                                     leaves shrink_qlist untouched   for_each_online_cpu()     skips CPU1  The objects left on CPU1\u0027s shrink_qlist are not returned to the slab allocator.  This may prevent kmem_cache_shrink() from releasing slabs that would otherwise become empty.  If CPU1 remains offline, a later kmem_cache_destroy() also skips the list and can report that the cache still contains objects.  An intermittent occurrence was observed with a virtio-9p filesystem.  The mount and umount commands both returned 0, but the kernel logged the following during the userspace-triggered teardown:    [  2994.380134][  T111] BUG 9p-fcall-cache-1 (Tainted: G    B              ): Objects remaining on __kmem_cache_shutdown()   [  2994.381140][  T111] Object 0xff11000004361118 @offset=4376   [  2994.381607][  T111] Allocated in p9_fcall_init\u002B0x201/0x400 age=19564 cpu=1 pid=104   [  2994.382591][  T111]  p9_fcall_init\u002B0x201/0x400   [  2994.382810][  T111]  p9_tag_alloc\u002B0x12f/0x700   [  2994.382982][  T111]  p9_client_prepare_req\u002B0x102/0x3e0   [  2994.383165][  T111]  p9_client_rpc\u002B0x1ab/0xa50   [  2994.383334][  T111]  p9_client_getattr_dotl\u002B0xb0/0x1a0   [  2994.383515][  T111]  v9fs_vfs_getattr_dotl\u002B0x115/0x360   [  2994.383719][  T111]  vfs_getattr_nosec\u002B0x22c/0x3a0   [  2994.383910][  T111]  vfs_statx\u002B0xd7/0x170   [  2994.384062][  T111]  vfs_fstatat\u002B0x45/0x80   [  2994.384215][  T111]  __do_sys_newfstatat\u002B0x84/0xe0   [  2994.384386][  T111]  do_syscall_64\u002B0x115/0x6a0   [  2994.384566][  T111]  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f   [  2994.399720][  T111] WARNING: mm/slub.c:1244 at __kmem_cache_shutdown\u002B0x363/0x500, CPU#0: busybox/111   [  2994.405655][  T111] Call Trace:   [  2994.406325][  T111]  kmem_cache_destroy\u002B0x73/0x1b0   [  2994.406630][  T111]  p9_client_destroy\u002B0x271/0x3c0   [  2994.407210][  T111]  v9fs_session_close\u002B0x3c/0x260   [  2994.407409][  T111]  v9fs_kill_super\u002B0x48/0x90   [  2994.407584][  T111]  deactivate_locked_super\u002B0xa3/0x160   [  2994.407778][  T111]  cleanup_mnt\u002B0x1dd/0x3e0  Thus, a successful umount left objects in the 9p fcall cache and prevented the cache from being destroyed cleanly.  Per-CPU shrink_qlist storage exists for every possible CPU, and each list is protected by its own raw spinlock.  Iterate over possible CPUs so that a list populated before its CPU went offline is drained as well.  for_each_possible_cpu() can do more work than for_each_online_cpu(), but this change only affects CONFIG_KASAN_GENERIC kernels.  The extra work is limited to cache shrink and cache destruction paths and does not affect the normal allocation/free fast path.  It adds one raw-spinlock-protected scan of each possible CPU\u0027s shrink list.  These lists are normally empty; a non-empty list is traversed to remove objects belonging to the cache being shrunk or destroyed.",
  "published": "2026-09-24T16:17:15Z",
  "severity": "Low",
  "cvss": 1.9,
  "epss": 0.00173,
  "epssPercentile": 0.06725,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93208",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-93208",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93208",
      "released": "2026-09-24T19:30:44Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93208",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93208",
      "released": "2026-09-24T19:30:44Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.111-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-93208",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93208",
      "released": "2026-09-24T19:30:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}