CVE-2026-93261

A flaw of moderate impact was found in the Linux kernel's lock dependency validator (lockdep). When register_lock_class() fails and returns NULL - for example when the lock class pool is exhausted, the graph lock cannot be acquired, or lock key validation fails - __lock_set_class() uses the NULL return value in pointer arithmetic without first checking it, which corrupts the held lock's internal class index. A subsequent reacquire_held_locks() operation then dereferences that corrupted index, causing a NULL or out-of-bounds memory dereference that crashes the kernel. A local user able to run code on the system can trigger this code path to cause a denial of service; the flaw has no confidentiality or integrity impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. The fix is currently deferred for the affected Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams; the residual risk of the deferral is limited to local denial of service, since exploitation requires local code execution and a lock class registration failure such as pool exhaustion or key validation failure within the lockdep validator.