CVE-2026-93810

A flaw was found in the Linux kernel's CacheFiles module. An error-handling defect in the cachefiles_create_tmpfile() function causes a file reference to be released twice (double fput) during failure scenarios. A local user could exploit this vulnerability to trigger memory corruption, resulting in a Denial of Service (DoS) through a system crash or potentially allowing privilege escalation.

A double fput error in cachefiles_create_tmpfile can occur when the cache backend does not provide read_iter or write_iter support. The first fput is executed before the error path, while the common cleanup path releases the same file reference again. This can result in a use-after-free of struct file and at minimum can crash the kernel. For the CVSS the PR:H metric reflects that cachefiles backend setup and reliable triggering normally require administrative control over cache configuration. The issue is not directly network reachable. The realistic impact is local denial of service. The memory lifetime error provides a plausible but unproven path to confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.