CVE-2026-93288

HighCVSS 7.8/10Last modified Oct 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()."

Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 24, 2026
Last modified
Oct 3, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-932897.5The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands durCVE-2026-932905.5Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mappCVE-2026-932919.4Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to eCVE-2026-932928.5SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicCVE-2026-932946.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those GrafanaCVE-2026-932958.7MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job argCVE-2026-932968.5MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the serCVE-2026-93308.5IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SCVE-2026-933007.5The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and inCVE-2026-933028.2MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macrCVE-2026-933037.2The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting viaCVE-2026-933043.7A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at tha
CVE-2026-93288: High severity, CVSS 7.8 | Vulnix