CVE-2026-93066 (GCVE-0-2026-93066)
Vulnerability from cvelistv5
Published
2026-09-17 16:10
Modified
2026-10-19 09:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: Take cpa_lock around large-page collapse
Loading and unloading modules concurrently on several CPUs on a KASAN
build, with a short delay injected at the CPA page-table lookup to
widen the window, faults within minutes:
BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
Write of size 8 at addr ffff888181139718 by task modprobe
...
The buggy address belongs to the physical page:
pfn:0x181139 ... page_type: f2(table)
cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and
frees the old PTE-table pages, while __change_page_attr() fetches a
PTE pointer from a lockless lookup_address_in_pgd_attr() and writes
it with set_pte_atomic() only later. When module text is served from
a shared large ROX mapping the two run on the same PMD:
CPU A (module load) CPU B (module finalize)
------------------- -----------------------
execmem_make_temp_rw
set_memory_nx
__change_page_attr
split 2M -> 4K table P
kpte = &P[i] (lockless)
execmem_restore_rox
set_memory_rox (CPA_COLLAPSE)
cpa_collapse_large_pages
rebuild leaf PMD
flush_tlb_all
pagetable_free(P)
set_pte_atomic(kpte, ...)
-> writes into freed P
P is a page-table page (page_type: table), reused at once, so the
write corrupts whatever got the page next: a bad-pte or bad-page
splat, or a fatal fault once P has been turned into read-only text.
The flush_tlb_all() before the free does not close this: its IPI only
serializes against page-table walkers that run with interrupts off
(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts
on, so nothing stops it from holding a stale pointer into P.
Serialize the collapse - the PMD rebuild, TLB flush and PTE-table
free - under cpa_lock, the same lock __change_page_attr() now takes
unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on
debug_pagealloc_enabled()"), so a concurrent walker can no longer
hold a pointer into a table the collapse is about to free.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/mm/pat/set_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "591b6fac9df3f43522e8ff6eed8662f8b6f1a124",
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"versionType": "git"
},
{
"lessThan": "fb97d1d6c20692e15247fa5c8b894b2325e38aee",
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"versionType": "git"
},
{
"lessThan": "1aac65f3e651334259ecb2a5f5ddb81c01f02599",
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/mm/pat/set_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Take cpa_lock around large-page collapse\n\nLoading and unloading modules concurrently on several CPUs on a KASAN\nbuild, with a short delay injected at the CPA page-table lookup to\nwiden the window, faults within minutes:\n\n BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0\n Write of size 8 at addr ffff888181139718 by task modprobe\n ...\n The buggy address belongs to the physical page:\n pfn:0x181139 ... page_type: f2(table)\n\ncpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and\nfrees the old PTE-table pages, while __change_page_attr() fetches a\nPTE pointer from a lockless lookup_address_in_pgd_attr() and writes\nit with set_pte_atomic() only later. When module text is served from\na shared large ROX mapping the two run on the same PMD:\n\n CPU A (module load) CPU B (module finalize)\n ------------------- -----------------------\n execmem_make_temp_rw\n set_memory_nx\n __change_page_attr\n split 2M -\u003e 4K table P\n kpte = \u0026P[i] (lockless)\n execmem_restore_rox\n set_memory_rox (CPA_COLLAPSE)\n cpa_collapse_large_pages\n rebuild leaf PMD\n flush_tlb_all\n pagetable_free(P)\n set_pte_atomic(kpte, ...)\n -\u003e writes into freed P\n\nP is a page-table page (page_type: table), reused at once, so the\nwrite corrupts whatever got the page next: a bad-pte or bad-page\nsplat, or a fatal fault once P has been turned into read-only text.\n\nThe flush_tlb_all() before the free does not close this: its IPI only\nserializes against page-table walkers that run with interrupts off\n(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts\non, so nothing stops it from holding a stale pointer into P.\n\nSerialize the collapse - the PMD rebuild, TLB flush and PTE-table\nfree - under cpa_lock, the same lock __change_page_attr() now takes\nunconditionally since commit (\"x86/mm/pat: stop gating cpa_lock on\ndebug_pagealloc_enabled()\"), so a concurrent walker can no longer\nhold a pointer into a table the collapse is about to free."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:05:02.188Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/591b6fac9df3f43522e8ff6eed8662f8b6f1a124"
},
{
"url": "https://git.kernel.org/stable/c/fb97d1d6c20692e15247fa5c8b894b2325e38aee"
},
{
"url": "https://git.kernel.org/stable/c/1aac65f3e651334259ecb2a5f5ddb81c01f02599"
}
],
"title": "x86/mm/pat: Take cpa_lock around large-page collapse",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93066",
"datePublished": "2026-09-17T16:10:51.612Z",
"dateReserved": "2026-09-17T15:57:05.660Z",
"dateUpdated": "2026-10-19T09:05:02.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…