{"id":"CVE-2026-97941","revision":null,"records":[{"revision":"3ba79a57ccbc477394a314cb3caaf2ce","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97941","aliases":[],"title":"mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race\n\nCommit ba7425312607 (\"mm, slab: add an optimistic\n__slab_try_return_freelist()\") incorrectly assumed that nobody has freed\nan object to the slab as long as slab->freelist is NULL and cmpxchg\nsucceeds.\n\nHowever, as reported by Hyunwoo Kim [1], other CPUs might have freed\nan object to the slab, insert the slab to the partial list, then\nallocated an object from the slab, and be in the middle of removing\nthe slab from the list under n->list_lock.\n\nSince __refill_objects_node() puts the slab back on pc.slabs\noutside n->list_lock, it might insert the slab into that list while\nthe slab is concurrently being removed from n->partial.\nThis led to a list corruption [1]:\n\n  list_add corruption. next->prev should be prev\n  (ffff888100000248), but was dead000000000122.\n  (next=ffffea000416e410).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted\n  7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)\n  RIP: 0010:__list_add_valid_or_report+0x80/0xd0\n  ...\n  Call Trace:\n   alloc_from_new_slab+0x183/0x300\n   ___slab_alloc+0x31c/0x890\n   __kmalloc_noprof+0x3d4/0x800\n   lsm_blob_alloc+0x2d/0x50\n   security_msg_msg_alloc+0x26/0x90\n   load_msg+0x1aa/0x210\n   do_msgsnd+0x91/0x800\n   do_syscall_64+0x109/0x5d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis is a classic ABA problem where cmpxchg succeeds but the state has\nchanged since __refill_objects_node() took the freelist from the slab.\n\nAs Vlastimil Babka mentioned [2], it should be rare to return more than\none slab (due to the racy read of slab->counters in\nget_partial_node_bulk()). Therefore, instead of introducing additional\ncomplexity, acquire and release n->list_lock twice in the worst case.\n\nReturn the slab directly to the partial list and hold n->list_lock\nacross the cmpxchg and add_partial(). This is similar to the initial\nversion of commit ba7425312607 [3]. This is enough to avoid the race as\nthe list manipulation is serialized by n->list_lock. While at it,\nbring back unlikely() hint now that the condition is unlikely.","state":0,"publishedAt":"2026-09-25T10:22:53.556+00:00","modifiedAt":"2026-10-19T09:11:07.833+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/slub.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ba742531260782a2646bc031f9a12cafebc22594\",\n                            \"lessThan\": \"570a6aaf6b52c6ec098f4811cdb52b1496f13d15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ba742531260782a2646bc031f9a12cafebc22594\",\n                            \"lessThan\": \"4a724bcf5d703e18957397914d79156fa2cf1174\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"mm/slub.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/570a6aaf6b52c6ec098f4811cdb52b1496f13d15","https://git.kernel.org/stable/c/4a724bcf5d703e18957397914d79156fa2cf1174"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97941","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97941","identifiers":["CVE-2026-97941"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T01:02:10.7447709+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T01:02:10.7447709+00:00","lastSuccessAt":"2026-11-09T01:02:10.8951096+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.8951131+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-06f887e3cff12cdbfc1e6b879a816e143efd9863ce6bea9ec9f7392bb9208c22","complete":true,"records":421267,"lastAttemptAt":"2026-11-09T01:02:10.4183693+00:00","lastSuccessAt":"2026-11-09T00:02:15.5944139+00:00","error":"InvalidOperationException","lastVerifiedAt":"2026-11-09T00:02:15.6996628+00:00","snapshotPublishedAt":"2026-11-08T23:22:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ad1daa57fd0d4d4ba18256a2340415a0","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T01:13:59.0733242+00:00","lastSuccessAt":"2026-11-09T01:13:59.069+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:13:59.069+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13626,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T01:02:10.7447709+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T01:02:10.7447709+00:00","lastSuccessAt":"2026-11-09T01:02:10.8958676+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.8958678+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cfd5ade15e524f2aab9bbdd1588fc1b0","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T01:02:13.0307833+00:00","lastSuccessAt":"2026-11-09T01:02:13.027+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:13.027+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T01:02:10.6696355+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.6696355+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T01:02:10.4684348+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.4684348+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3b1150af6d7ada2c07356cbab4ead5224c1485027890f71c71d0742cddf0b9e8","complete":true,"records":3055,"lastAttemptAt":"2026-11-09T01:02:10.6816953+00:00","lastSuccessAt":"2026-11-09T00:02:23.4330288+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.6816953+00:00","snapshotPublishedAt":"2026-11-08T23:17:54+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-09T01:02:10.5692363+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-09T01:02:10.5692363+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}