CVE-2026-93795 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems should assess their exposure and verify the presence of the fix to prevent potential memory leaks and system instability. Linux kernel users and maintainers should assess exposure and verify the presence of the fix in their systems.

Why it matters

Linux kernel users and maintainers should assess exposure and verify the presence of the fix to prevent potential memory leaks and system instability.

• Memory leaks due to unreleased blk-cgroup resources
• Potential system instability due to unaddressed blk-cgroup issues
• Verification of fix presence required for secure operation

Technical summary

The vulnerability involves a fix for leaks and the online flag on radix_tree_insert failure in the blk-cgroup subsystem of the Linux kernel. The error path in blkg_create() had two issues: it unconditionally set blkg->online to true, even if the blkg was never fully inserted, and it called blkg_put() without first calling percpu_ref_kill(), leading to permanent leaks of blkg memory, its percpu iostat, policy data, the parent blkg reference, and the cgroup css reference. Linux kernel users and maintainers should assess exposure and verify the presence of the fix in their systems to prevent potential memory leaks and system instability.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the presence of the fix in their systems.

Recommended defensive actions

• Review Linux kernel versions and ensure the fix is applied
• Verify system configurations for blk-cgroup usage
• Monitor for potential memory leaks and performance issues
• Confirm whether affected Linux kernel deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution. Three source references from the Linux kernel Git repository are provided, detailing the specific commits that address the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.