CVE-2026-93073

What the bug is

dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() -- once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (kill_dax() also clears holder_ops, but only after synchronize_srcu(), so it cannot race a reader that is inside dax_read_lock(); fs_put_dax() does no such synchronization.) Fetch holder_ops once into a local with READ_ONCE() so the NULL check and the indirect call observe the same value.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/dax/super.c

What this is

DEVICE DIRECT ACCESS (DAX)MAINTAINERS section matched on drivers/dax/ · nvdimm@lists.linux.dev · Supported

Kernel module

dax

Check it on the machine

grep -w CONFIG_DAX /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w dax

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormBnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, ppc64el/powerpc64le
• trixieYnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
• forky, sidYnot built on armhf/armmp, armhf/armmp-lpae
• bookworm · linux-6.12Ynot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp

B

built in on some, a module on others, absent on the rest

Y

built in where it is built at all; some flavours do not build it

Build switch

CONFIG_DAX

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-17 (31 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.18%, higher than 7.1% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/dax

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.0	6.1.188	1661b9bf78de
6.0	6.6.157	0a42180d5410
6.0	6.12.110	ee1251621d1c
6.0	6.18.52	6a37acecc7c2
6.0	7.2.6	eb412f80311f
6.0	7.3	7ae9d15bdcde

Debian advisories