CVE-2026-93279staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in the queue which might run after the cvm_oct_remove() frees net_device structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it iterates cvm_oct_device[] which is an array of netdevice pointers. Add tasklet_kill() after free_irq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4898c560103fb8075c10a8e9d70e0ca26873075e builds before 32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486; from 4898c560103fb8075c10a8e9d70e0ca26873075e before d15226338dfaa84ffff142d32723cdf74d0c47c4; from 4898c560103fb8075c10a8e9d70e0ca26873075e before a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19; from 4898c560103fb8075c10a8e9d70e0ca26873075e before b6365e4186322858a82c8713b1d0bd209c8e765a; 4898c560103fb8075c10a8e9d70e0ca26873075e builds before 03d12490afd1198310ad0aba42462329832eb739; 4898c560103fb8075c10a8e9d70e0ca26873075e builds before 2c0c9956596e48654bb4855e2a0742748a0826a7; 4898c560103fb8075c10a8e9d70e0ca26873075e builds before 41a79bd9e5a74f8f483b3b206d10567912874fb4; from 4898c560103fb8075c10a8e9d70e0ca26873075e before b9af44b0d20b2247c4eb0ea5cfca907d643eea50 | CNA record |
References
- https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486
- https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4
- https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19
- https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a
- https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739
- https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7
- https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4
- https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.