{"cve":"CVE-2026-93829","nvd":{"published":"2026-09-24T17:17:16.630","modified":"2026-10-03T11:17:52.570","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix races in cifsd thread creation\n\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\n\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\n\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0eee1e6cddd1d9ce14da06e0238ca8d3362dec90","https://git.kernel.org/stable/c/cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5","https://git.kernel.org/stable/c/e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d","https://git.kernel.org/stable/c/ee8f811cbac56ffb738b3a73671a9e75b0f56e99"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-93829","score":0.00168,"percentile":0.06027,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}