{"id":"CVE-2026-93261","summary":"locking/lockdep: Fix NULL pointer dereference in __lock_set_class()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/lockdep: Fix NULL pointer dereference in __lock_set_class()\n\nregister_lock_class() can return NULL when the lock class pool is\nexhausted, graph_lock() fails, or key validation fails. However,\n__lock_set_class() uses the return value directly in pointer arithmetic\nwithout a NULL check:\n\n  class = register_lock_class(lock, subclass, 0);\n  hlock-\u003eclass_idx = class - lock_classes;\n\nIf class is NULL, this computes a wild offset that corrupts\nhlock-\u003eclass_idx. The subsequent reacquire_held_locks() call will\ninvoke hlock_class() with this corrupted index, leading to a NULL or\nout-of-bounds pointer dereference.\n\nAdd the missing NULL check, consistent with how __lock_acquire() already\nhandles this case at the same call site.","modified":"2026-09-25T03:48:54.323463434Z","published":"2026-09-24T15:51:59.638Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93261.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5c3bff6cf26e6a54fbf8b893a879c32824d2d50d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7577e00b9ab506202b9f1a33de3cc8cc6413a4db"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9be10f49dfc2e4b472b3a5f346483b67374774b8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b2113dcd8238bf00ce37a34e67b29cf31d32a545"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e7c69c6695d84220847cca62a45e879e71e79e9d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f56e54fd24f05e9de528fcb77f6084f80c8066ce"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f6093ff67ea6e347574819ed23e96e0f82a25ffc"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93261.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93261"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"64aa348edc617dea17bbd01ddee4e47886d5ec8c"},{"fixed":"f6093ff67ea6e347574819ed23e96e0f82a25ffc"},{"fixed":"59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2"},{"fixed":"f56e54fd24f05e9de528fcb77f6084f80c8066ce"},{"fixed":"5c3bff6cf26e6a54fbf8b893a879c32824d2d50d"},{"fixed":"b2113dcd8238bf00ce37a34e67b29cf31d32a545"},{"fixed":"e7c69c6695d84220847cca62a45e879e71e79e9d"},{"fixed":"9be10f49dfc2e4b472b3a5f346483b67374774b8"},{"fixed":"7577e00b9ab506202b9f1a33de3cc8cc6413a4db"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93261.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.27"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93261.json"}}],"schema_version":"1.9.0"}