CVE-2026-93075: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-m6jw-vjqw-78fh
Share
Published
Advisory Summary

CVE-2026-93075 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93075 at a Glance

CVE Identifier CVE-2026-93075
GHSA Identifier GHSA-m6jw-vjqw-78fh
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-93075

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93075, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and pgmap->owner = dev_dax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this is harmless. For a static device the pgmap is the shared, long-lived one owned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the non-static case), and device.c's probe sets only pgmap->type, never clearing ops/owner. So after fsdev unbinds a static device the stale fsdev_pagemap_ops survives on the shared pgmap. If the device is then rebound to device_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure), or the fsdev_dax module is unloaded, a subsequent memory_failure on that pgmap dispatches through the stale -- and possibly freed -- handler. Register a devm action that clears pgmap->ops and pgmap->owner on unbind, symmetric with setting them at probe, so the pgmap carries no fsdev state once fsdev is detached.

References

NVD — CVE-2026-93075 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93075
git.kernel.org/stable/c/9b0f91dc91... WEB
https://git.kernel.org/stable/c/9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27
git.kernel.org/stable/c/f48884ac31... WEB
https://git.kernel.org/stable/c/f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7

Frequently Asked Questions

What is CVE-2026-93075?
CVE-2026-93075 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93075?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-93075?
CVE-2026-93075 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93075?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m6jw-vjqw-78fh",
  "modified" : "2026-09-17T18:32:09Z",
  "published" : "2026-09-17T18:32:09Z",
  "aliases" : [ "CVE-2026-93075" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndax/fsdev: clear pgmap ops and owner on unbind\n\nfsdev_dax_probe() sets pgmap->ops = &fsdev_pagemap_ops and\npgmap->owner = dev_dax, but nothing ever clears them. For a dynamic\ndevice the pgmap is devm-allocated and freed on unbind, so this is\nharmless. For a static device the pgmap is the shared, long-lived one\nowned by the dax bus (kill_dev_dax() only NULLs dev_dax->pgmap for the\nnon-static case), and device.c's probe sets only pgmap->type, never\nclearing ops/owner.\n\nSo after fsdev unbinds a static device the stale fsdev_pagemap_ops\nsurvives on the shared pgmap. If the device is then rebound to\ndevice_dax (MEMORY_DEVICE_GENERIC, which installs no ->memory_failure),\nor the fsdev_dax module is unloaded, a subsequent memory_failure on that\npgmap dispatches through the stale -- and possibly freed -- handler.\n\nRegister a devm action that clears pgmap->ops and pgmap->owner on unbind,\nsymmetric with setting them at probe, so the pgmap carries no fsdev state\nonce fsdev is detached.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93075"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:18:01Z"
  }
}