CVE-2026-93073

A flaw was found in the Linux kernel's Direct Access (DAX) subsystem. A race condition in the dax_holder_notify_failure() function allows a concurrent operation to clear a critical pointer (holder_ops) between two reads. This can lead to a null pointer dereference, potentially enabling a local attacker to cause a system crash, resulting in a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation is limited to a local denial of service via a kernel crash and cannot be leveraged for arbitrary code execution or data exposure. The flaw resides in the Direct Access (DAX) storage subsystem, which requires specific hardware configurations such as persistent memory and concurrent race timing to trigger. While Red Hat Enterprise Linux 9 and 10 kernels are affected, earlier releases like RHEL 7 and 8 do not include the vulnerable implementation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.