---
id: CVE-2026-93262
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid5-ppl: fix use-after-free in ppl_do_flush()

  The loop in ppl_do_flush() continues iterating after calling
  ppl_io_unit_finished(), touching io->pending_flushes an…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  md/raid5-ppl: fix use-after-free in ppl_do_flush()

  The loop in ppl_do_flush() continues iterating after calling
  ppl_io_unit_finished(), touching io->pending_flushes an…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    cf01f9413565e86673baf927291a088b6975692b
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    e7505842f1329ece90cb9ea0db87772aeca44052
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    b5123bf667ac29ddd8106f9ca7cc01316513ae66
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    e77c80670f2c2bf491da9b173931e1da4677c23a
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    8914c3d40870f16429a326e97e4016bedc6ede4c
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    455b56209f9615c3902dcc398dd867abb5ade3ab
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    fcf21df7d3c50c8ebeb0757df5d21b02dcae4218
  - >-
    Linux >= 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 <
    371f7a1b392edc8b7cf449cc7713179b588f2d0e
  - Linux 4.16
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:22.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93262'
references:
  - url: 'https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.835Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-ppl: fix use-after-free in ppl_do_flush()

The loop in ppl_do_flush() continues iterating after calling
ppl_io_unit_finished(), touching io->pending_flushes and leading to a
use-after-free.

Add a break statement to stop the loop once io is freed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.