CVE-2026-93284

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/pagemap: dma-unmap pages before handling migration errors

drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward.

Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Oct 19, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-93285In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs_gc_kthread in f2fs_sb_info Instead of allocating f2fs CVE-2026-93286In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_s CVE-2026-932877.8In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SM CVE-2026-932887.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pern CVE-2026-932897.5The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands dur CVE-2026-932905.5Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapp CVE-2026-932919.4Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to e CVE-2026-932928.5SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servic CVE-2026-932946.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana CVE-2026-932958.7MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arg CVE-2026-932968.5MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the ser CVE-2026-93308.5IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the S