CVE-2026-93152nvme-apple: Use acquire/release for queue enabled state
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state apple_nvme_init_queue() initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state. The old wmb() after WRITE_ONCE(enabled, true) does not publish the earlier initialization before enabled becomes visible. Use a release store when enabling the queue and acquire loads when testing it. Although the shutdown-side enabled accesses are not used for publishing queue initialization, use helpers for them as well for consistency.
Timeline
ID reserved
By Linux
Published
- 32 days later
· 32 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < cbe53ecd696e354bfda8173364f7595759bc562d
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < 86782a72c6d8c7541813b9ddb009668468601f18
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < 0e9d9fe12da779516dc3899dc9141304675f5416
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < e5a79244a3c526a76d930f2ef30aff64528b0c6a
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < 840ab22ffa4d859ca40a31e96fc3554688e7a035
- affected 5bd2927aceba181b84286e00aa2f56e117e699c3 – < f61c934aa084b7440fec681be3f4b481eb5a8609
- affected 5.19
- unaffected < 5.19
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/cbe53ecd696e354bfda8173364f7595759bc562d (opens in a new tab)
- https://git.kernel.org/stable/c/86782a72c6d8c7541813b9ddb009668468601f18 (opens in a new tab)
- https://git.kernel.org/stable/c/0e9d9fe12da779516dc3899dc9141304675f5416 (opens in a new tab)
- https://git.kernel.org/stable/c/e5a79244a3c526a76d930f2ef30aff64528b0c6a (opens in a new tab)
- https://git.kernel.org/stable/c/840ab22ffa4d859ca40a31e96fc3554688e7a035 (opens in a new tab)
- https://git.kernel.org/stable/c/f61c934aa084b7440fec681be3f4b481eb5a8609 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-82260 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-93152)Record last updated .