CVE-2026-97941Linux Kernel Vulnerability
Linux kernel: mm/slab: take n->list_lock in slab_try_return_freelist() to avoid race
Published Sep 25, 2026 · Updated Oct 19, 2026 · Also known as EUVD-2026-86795, GHSA-jvph-rmf4-fgm6
Key Facts
Patch in the next maintenance window- CVE-2026-97941 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Linux Kernel, Linux (debian), kernel-devel (suse) and 4 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including Kernel 7.2.7, kernel-devel 7.2.9-1.1, kernel-macros 7.2.9-1.1.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
0.2%
Higher than 4.0% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
40/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: take n->list_lock in slab_try_return_freelist() to avoid race
Commit ba7425312607 ("mm, slab: add an optimistic slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds.
However, as reported by Hyunwoo Kim [1], other CPUs might have freed an object to the slab, insert the slab to the partial list, then allocated an object from the slab, and be in the middle of removing the slab from the list under n->list_lock.
Since refill_objects_node() puts the slab back on pc.slabs outside n->list_lock, it might insert the slab into that list while the slab is concurrently being removed from n->partial. This led to a list corruption [1]:
list_add corruption. next->prev should be prev (ffff888100000248), but was dead000000000122. (next=ffffea000416e410). kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted 7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy) RIP: 0010:list_add_valid_or_report+0x80/0xd0 ...
Call Trace: alloc_from_new_slab+0x183/0x300 _slab_alloc+0x31c/0x890 kmalloc_noprof+0x3d4/0x800 lsm_blob_alloc+0x2d/0x50 security_msg_msg_alloc+0x26/0x90 load_msg+0x1aa/0x210 do_msgsnd+0x91/0x800 do_syscall_64+0x109/0x5d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Kernel panic - not syncing: Fatal exception
This is a classic ABA problem where cmpxchg succeeds but the state has changed since refill_objects_node() took the freelist from the slab.
As Vlastimil Babka mentioned [2], it should be rare to return more than one slab (due to the racy read of slab->counters in get_partial_node_bulk()). Therefore, instead of introducing additional complexity, acquire and release n->list_lock twice in the worst case.
Return the slab directly to the partial list and hold n->list_lock across the cmpxchg and add_partial(). This is similar to the initial version of commit ba7425312607 [3]. This is enough to avoid the race as the list manipulation is serialized by n->list_lock. While at it, bring back unlikely() hint now that the condition is unlikely.
Affected Products
12 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Linux KernelLinux | See advisory | 7.2.7 |
| Linuxdebian | >= ba742531260782a2646bc031f9a12cafebc22594 | 0 |
| kernel-develsuse | See advisory | 7.2.9-1.1 |
| kernel-macrossuse | See advisory | 7.2.9-1.1 |
| kernel-sourcesuse | See advisory | 7.2.9-1.1 |
Patched Releases
Kernel
7.2.7
kernel-devel
7.2.9-1.1
kernel-macros
7.2.9-1.1
kernel-source
7.2.9-1.1
kernel-source-vanilla
7.2.9-1.1
Linux
7.2.7-1, 4a724bcf5d703e18957397914d79156fa2cf1174, 570a6aaf6b52c6ec098f4811cdb52b1496f13d15, 7.2.7
Linux Kernel
7.2.7, 7.3-rc3
Timeline
Publicly disclosed
Sep 25, 2026
Last updated
Oct 19, 2026
Weakness Type
- CWE-366 Race Condition within a Thread
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-97941
- advisorygit.kernel.org · linux.git
- advisoryUSOM advisory
- othergit.kernel.org · linux.git
FAQ
Common Questions.
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL a…
Affected: Linux Kernel; Linux (debian) versions >= ba742531260782a2646bc031f9a12cafebc22594; kernel-devel (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Kernel 7.2.7, kernel-devel 7.2.9-1.1, kernel-macros 7.2.9-1.1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-97941 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo