CVE-2026-93215 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
cdx: Fix double free when sysfs file creation fails
In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This
leaves a dangling pointer in the array. Then cdx_destroy_res_attr() frees the already-freed memory. Fix the double free by initializing cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified within the CDX subsystem involves a critical resource management flaw in the function responsible for creating system file attributes, specifically cd x_create_res_attr. This issue manifests as a double free condition that occurs during the initialization phase when the creation of a sysfs binary file fails due to underlying system constraints or errors. The root cause lies in an incomplete error handling path where memory allocated for resource attribute structures is released prematurely without properly updating the state of the parent device structure. When sysfs_create_bin_file returns an error code indicating failure, the current implementation proceeds to free the res_attr pointer but neglects to nullify the corresponding entry within the cdx_dev->res_attr array. This oversight leaves a dangling pointer that still references memory which has already been returned to the kernel allocator or potentially reused by other allocations.
The operational impact of this flaw becomes apparent when subsequent operations attempt to clean up these resources, such as during device removal or subsystem teardown via cd x_destroy_res_attr. Because the array entry was not cleared upon initial failure, the cleanup routine perceives the pointer as valid and attempts to free it again. This double free scenario corrupts kernel memory management structures, potentially leading to system instability, crashes, or denial of service conditions for local users who can trigger the specific code path that causes sysfs creation failures. In more severe scenarios involving crafted inputs or race conditions, such memory corruption could theoretically be exploited to achieve arbitrary code execution by manipulating heap metadata before the double free occurs, although exploitation complexity is typically high due to kernel-level protections and ASLR mechanisms.
From a vulnerability classification perspective, this defect aligns with CWE-415 Double Free, which describes situations where an application frees a block of memory twice without ensuring that the pointer has been properly invalidated or reassigned between operations. This type of error undermines the integrity of dynamic memory management routines essential for kernel stability. Furthermore, within the context of attack vectors and techniques, this vulnerability relates to CWE-401 Missing Release of Memory after Effective Lifetime if viewed broadly as a resource leak precursor, but more accurately fits into exploitation paths associated with heap corruption attacks described in MITRE ATT&CK technique T1203 Exploitation for Defense Evasion or potentially T1059 Command and Scripting Interpreter if the double free leads to code execution. The failure to handle errors correctly represents a gap in defensive coding practices where assumptions about successful API calls are not sufficiently guarded against edge cases involving resource allocation failures.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the logic flow within cd x_create_res_attr. Developers and system administrators should ensure their systems are updated with versions of the Linux kernel containing this fix, which explicitly sets cdx_dev->res_attr[num] to NULL immediately after sysfs_create_bin_file completes successfully or handles the failure case by ensuring no further references remain to the freed memory. For organizations managing large fleets of devices running affected kernel versions, prioritizing patch deployment is critical to prevent potential stability issues and security risks associated with heap corruption. Additionally, code review processes should enforce strict validation that all pointers are nullified after deallocation in error paths to prevent similar double free vulnerabilities across other subsystems within the operating system core.