CVE-2026-97941

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/4a724bcf5d703e18957397914d79156fa2cf1174 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/570a6aaf6b52c6ec098f4811cdb52b1496f13d15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-97941.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "570a6aaf6b52c6ec098f4811cdb52b1496f13d15",
              "status": "affected",
              "version": "ba742531260782a2646bc031f9a12cafebc22594",
              "versionType": "git"
            },
            {
              "lessThan": "4a724bcf5d703e18957397914d79156fa2cf1174",
              "status": "affected",
              "version": "ba742531260782a2646bc031f9a12cafebc22594",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race\n\nCommit ba7425312607 (\"mm, slab: add an optimistic\n__slab_try_return_freelist()\") incorrectly assumed that nobody has freed\nan object to the slab as long as slab->freelist is NULL and cmpxchg\nsucceeds.\n\nHowever, as reported by Hyunwoo Kim [1], other CPUs might have freed\nan object to the slab, insert the slab to the partial list, then\nallocated an object from the slab, and be in the middle of removing\nthe slab from the list under n->list_lock.\n\nSince __refill_objects_node() puts the slab back on pc.slabs\noutside n->list_lock, it might insert the slab into that list while\nthe slab is concurrently being removed from n->partial.\nThis led to a list corruption [1]:\n\n  list_add corruption. next->prev should be prev\n  (ffff888100000248), but was dead000000000122.\n  (next=ffffea000416e410).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted\n  7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)\n  RIP: 0010:__list_add_valid_or_report+0x80/0xd0\n  ...\n  Call Trace:\n   alloc_from_new_slab+0x183/0x300\n   ___slab_alloc+0x31c/0x890\n   __kmalloc_noprof+0x3d4/0x800\n   lsm_blob_alloc+0x2d/0x50\n   security_msg_msg_alloc+0x26/0x90\n   load_msg+0x1aa/0x210\n   do_msgsnd+0x91/0x800\n   do_syscall_64+0x109/0x5d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis is a classic ABA problem where cmpxchg succeeds but the state has\nchanged since __refill_objects_node() took the freelist from the slab.\n\nAs Vlastimil Babka mentioned [2], it should be rare to return more than\none slab (due to the racy read of slab->counters in\nget_partial_node_bulk()). Therefore, instead of introducing additional\ncomplexity, acquire and release n->list_lock twice in the worst case.\n\nReturn the slab directly to the partial list and hold n->list_lock\nacross the cmpxchg and add_partial(). This is similar to the initial\nversion of commit ba7425312607 [3]. This is enough to avoid the race as\nthe list manipulation is serialized by n->list_lock. While at it,\nbring back unlikely() hint now that the condition is unlikely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is in __refill_objects_node()/__slab_try_return_freelist() in mm/slub.c, which runs when the slab allocator refills its per-CPU object cache for kmalloc. It is reached from local syscalls such as msgsnd() (do_msgsnd -> load_msg -> __kmalloc -> ___slab_alloc in the reporter's trace). No remote data is involved.\nAC:L - The attacker's own threads on several CPUs do the allocating and freeing (e.g. msgsnd/msgrcv) that returns the slab to n->partial and pulls it off again while the refill re-links it outside n->list_lock. The attacker drives both sides of the race, and the reporter's reproducer hit it.\nPR:L - No capability is needed. Any unprivileged process that does kmalloc-backed syscalls reaches the refill path, and the reported crash came from a process running as UID 65534 (nobody) calling msgsnd.\nUI:N - The attacker triggers the race entirely with their own allocation and free syscalls. No other user has to do anything.\nS:U - The corruption is in the kernel's own slab lists, and the impact stays within the kernel's security authority as ordinary local privilege escalation or crash.\nC:H - The ABA race leaves slab->slab_list linked on both the local pc.slabs list and n->partial. The same slab can then be handed out twice, giving overlapping kmalloc objects (a use-after-free-class primitive) that can be groomed to read kernel memory.\nI:H - A slab handed out twice lets an attacker put a controlled object (e.g. msg_msg) on top of a live kernel object in a general kmalloc cache. That enables arbitrary write and control-flow hijack, and the corrupted list pointers are themselves a write primitive.\nA:H - The reproducer hits a list_add corruption BUG (next->prev = dead000000000122) in alloc_from_new_slab and the kernel panics with \"Fatal exception\". An unprivileged user can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:43.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/570a6aaf6b52c6ec098f4811cdb52b1496f13d15"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a724bcf5d703e18957397914d79156fa2cf1174"
        }
      ],
      "title": "mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97941",
    "datePublished": "2026-09-25T10:22:53.556Z",
    "dateReserved": "2026-09-25T10:18:58.204Z",
    "dateUpdated": "2026-09-25T14:41:43.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}