NULL Pointer Dereference in Linux Kernel Locking Mechanism

CVE-2026-93261

What is CVE-2026-93261?

A vulnerability in the Linux kernel allows for a NULL pointer dereference within the locking subsystem. Specifically, when the lock class pool is exhausted or validation fails, the function __lock_set_class() incorrectly assumes a valid return value from register_lock_class(). This oversight can lead to wild pointer arithmetic, which corrupts the hlock->class_idx value. Consequently, subsequent calls to reacquire held locks attempt to access invalid memory, potentially resulting in application crashes or security breaches. The fix introduces a necessary NULL check, aligning behavior with the existing protections in __lock_acquire().

References