# CVE-2026-93253: linux: In the Linux kernel, the following vulnerability has been resolved:  sched/isolation: Defer freeing of cpumask memblo...

CVE-2026-93253 is fixed in linux on 1 platform by DEBIAN-CVE-2026-93253 (version 7.2.6-1), released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-93253
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 24, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  sched/isolation: Defer freeing of cpumask memblock memory to initcall  When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock: warn when freeing reserved memory before memory map is initialized"), the following warning was hit when there was a "nohz_full" kernel boot parameter.    Cannot free reserved memory because of deferred initialization of the memory map   WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0     :   Call Trace:    <TASK>    memblock_phys_free+0xcb/0x100    housekeeping_init+0x14c/0x170    start_kernel+0x207/0x450    x86_64_start_reservations+0x24/0x30    x86_64_start_kernel+0xda/0xe0    common_startup_64+0x13e/0x141    </TASK>  IOW, we shouldn't free memblock allocated memory so early in the boot process when memory map isn't fully initialized in deferred_init_memmap().  Fix it by saving the housekeeping cpumask memblock memory to be freed into a llist free list in housekeeping_init() and add a new housekeeping_late_init() helper to defer the actual freeing of memblock memory to when initcall's are being processed. The cpumask memblock memory is treated as a llist_node with the size of a "long" type which is also smallest cpumask size that can be allocated.  The non-atomic version of the llist APIs are used as there is no contention.  This commit depends on the presence of commit 7c2eee9c1367 ("memblock: don't touch memblock arrays when memblock_free() is called late") to prevent a KASAN UAF bug report [1].   [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-93253](https://patchblox.com/security/data/fix/linux/debian-cve-2026-93253.md) | Sep 24, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.