CVE-2026-93138: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlin
Summary
A race condition (a timing bug where two processes access shared data simultaneously without proper coordination) was found in the Linux kernel's bpf_get_btf_vmlinux() function, where one thread could read incomplete data published by another thread because the pointer was shared without proper synchronization (memory ordering guarantees). The fix uses smp_store_release() and smp_load_acquire() (special CPU instructions that ensure data is fully written and read in the correct order on weakly ordered architectures, where CPU cores can process instructions out of order).
Solution / Mitigation
Publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire(). These CPU-level synchronization operations ensure that all data is properly initialized before the pointer is made visible to other threads, and that readers see the complete initialization.
Vulnerability Details
EPSS: 0.0%
September 17, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-93138
First tracked: September 17, 2026 at 02:07 PM
Classified by LLM (prompt v3) · confidence: 95%