CVE-2026-93158: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-x4wf-3pq8-hcp4
Share
Published
Advisory Summary

CVE-2026-93158 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93158 at a Glance

CVE Identifier CVE-2026-93158
GHSA Identifier GHSA-x4wf-3pq8-hcp4
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-93158

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93158, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails sa_ul_probe() calls sa_init_mem() to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA setup, algorithm registration and child population even though later request setup depends on that pool. Stop probing when sa_init_mem() fails, and route that failure to the PM cleanup path without attempting to destroy an uncreated DMA pool.

References

NVD — CVE-2026-93158 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93158
git.kernel.org/stable/c/04c46784ec... WEB
https://git.kernel.org/stable/c/04c46784ec249cac995e31f0691397b82bdaa5fd
git.kernel.org/stable/c/304dcd26bf... WEB
https://git.kernel.org/stable/c/304dcd26bfc3ce6771c2bd3b7c0299dcfd5f4e06
git.kernel.org/stable/c/91ded4742f... WEB
https://git.kernel.org/stable/c/91ded4742fcde6ad415c4d8a20e5ea0dcdf4f73e
git.kernel.org/stable/c/9907426b43... WEB
https://git.kernel.org/stable/c/9907426b438e4dbc8c45138bd440ad6d732d80b7
git.kernel.org/stable/c/9a692a6a2b... WEB
https://git.kernel.org/stable/c/9a692a6a2b47328a36c8d80c7fbf81da16b6d6b1
git.kernel.org/stable/c/b68b35ed97... WEB
https://git.kernel.org/stable/c/b68b35ed97d3e18edb9dea500d88420a95006742
git.kernel.org/stable/c/d03f980a25... WEB
https://git.kernel.org/stable/c/d03f980a25853f6a380895119a572a3bb1194e8d
git.kernel.org/stable/c/f72c783761... WEB
https://git.kernel.org/stable/c/f72c7837614a9705f8b3021828d49c9f095803ba

Frequently Asked Questions

What is CVE-2026-93158?
CVE-2026-93158 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93158?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-93158?
CVE-2026-93158 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93158?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x4wf-3pq8-hcp4",
  "modified" : "2026-09-17T18:32:12Z",
  "published" : "2026-09-17T18:32:12Z",
  "aliases" : [ "CVE-2026-93158" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: sa2ul - stop probe if context pool creation fails\n\nsa_ul_probe() calls sa_init_mem() to create the DMA pool used for\nsecurity context buffers, but ignores its return value. If pool creation\nfails, probe still continues with DMA setup, algorithm registration and\nchild population even though later request setup depends on that pool.\n\nStop probing when sa_init_mem() fails, and route that failure to the PM\ncleanup path without attempting to destroy an uncreated DMA pool.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93158"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/04c46784ec249cac995e31f0691397b82bdaa5fd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/304dcd26bfc3ce6771c2bd3b7c0299dcfd5f4e06"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/91ded4742fcde6ad415c4d8a20e5ea0dcdf4f73e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9907426b438e4dbc8c45138bd440ad6d732d80b7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a692a6a2b47328a36c8d80c7fbf81da16b6d6b1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b68b35ed97d3e18edb9dea500d88420a95006742"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d03f980a25853f6a380895119a572a3bb1194e8d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f72c7837614a9705f8b3021828d49c9f095803ba"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:18:11Z"
  }
}