CVE-2026-93066 - Vulnerability Details

- x86/mm/pat: Take cpa_lock around large-page collapse

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Take cpa_lock around large-page collapse

Loading and unloading modules concurrently on several CPUs on a KASAN
build, with a short delay injected at the CPA page-table lookup to
widen the window, faults within minutes:

BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
Write of size 8 at addr ffff888181139718 by task modprobe
...
The buggy address belongs to the physical page:
pfn:0x181139 ... page_type: f2(table)

cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and
frees the old PTE-table pages, while __change_page_attr() fetches a
PTE pointer from a lockless lookup_address_in_pgd_attr() and writes
it with set_pte_atomic() only later. When module text is served from
a shared large ROX mapping the two run on the same PMD:

CPU A (module load) CPU B (module finalize)
------------------- -----------------------
execmem_make_temp_rw
set_memory_nx
__change_page_attr
split 2M -> 4K table P
kpte = &P[i] (lockless)
execmem_restore_rox
set_memory_rox (CPA_COLLAPSE)
cpa_collapse_large_pages
rebuild leaf PMD
flush_tlb_all
pagetable_free(P)
set_pte_atomic(kpte, ...)
-> writes into freed P

P is a page-table page (page_type: table), reused at once, so the
write corrupts whatever got the page next: a bad-pte or bad-page
splat, or a fatal fault once P has been turned into read-only text.

The flush_tlb_all() before the free does not close this: its IPI only
serializes against page-table walkers that run with interrupts off
(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts
on, so nothing stops it from holding a stale pointer into P.

Serialize the collapse - the PMD rebuild, TLB flush and PTE-table
free - under cpa_lock, the same lock __change_page_attr() now takes
unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on
debug_pagealloc_enabled()"), so a concurrent walker can no longer
hold a pointer into a table the collapse is about to free.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a use‑after‑free bug that occurs when a large page table (PMD) is collapsed while another thread holds a stale pointer to the page‑table page. The bug allows a write to freed memory, corrupting kernel data structures and potentially enabling arbitrary code execution in kernel mode.

Affected Systems

All Linux kernel builds that implement CPA page collapse without the fix, including those compiled with KASAN support, are vulnerable. No specific version range is listed, so any kernel prior to the commit that serializes the collapse operation is at risk.

Risk and Exploitability

Although the EPSS score is below 1% and the vulnerability is not in CISA’s KEV catalog, the use‑after‑free can provide a powerful local privilege escalation path. Exploitation requires concurrent module load and unload on a multi‑CPU system and may be easier on KASAN builds, but the lack of a public exploit suggests that the risk remains modest until the patch is deployed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`41d88484c71cd4f659348da41b7b5b3dbd3be1f6`	affected	< 591b6fac9df3f43522e8ff6eed8662f8b6f1a124
`41d88484c71cd4f659348da41b7b5b3dbd3be1f6`	affected	< fb97d1d6c20692e15247fa5c8b894b2325e38aee
`41d88484c71cd4f659348da41b7b5b3dbd3be1f6`	affected	< 1aac65f3e651334259ecb2a5f5ddb81c01f02599

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[41d88484c71cd4f659348da41b7b5b3dbd3be1f6,591b6fac9df3f43522e8ff6eed8662f8b6f1a124)`	affected	code_commit	—
`[41d88484c71cd4f659348da41b7b5b3dbd3be1f6,fb97d1d6c20692e15247fa5c8b894b2325e38aee)`	affected	code_commit	—
`[41d88484c71cd4f659348da41b7b5b3dbd3be1f6,1aac65f3e651334259ecb2a5f5ddb81c01f02599)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the system to the latest Linux kernel that contains the commit which acquires `cpa_lock` during large‑page collapse.
Restart the kernel (reboot) so that the updated code takes effect.
If a kernel update cannot be applied immediately, avoid loading kernel modules concurrently on multicore processors when running a KASAN build, until the patch is available.

Generated by OpenCVE AI on September 19, 2026 at 06:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1aac65f3e651334259ecb2a5f5ddb81c01f02599
https://git.kernel.org/stable/c/591b6fac9df3f43522e8ff6eed8662f8b6f1a124
https://git.kernel.org/stable/c/fb97d1d6c20692e15247fa5c8b894b2325e38aee

History

Sat, 19 Sep 2026 07:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpa_lock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes: BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 Write of size 8 at addr ffff888181139718 by task modprobe ... The buggy address belongs to the physical page: pfn:0x181139 ... page_type: f2(table) cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD: CPU A (module load) CPU B (module finalize) ------------------- ----------------------- execmem_make_temp_rw set_memory_nx __change_page_attr split 2M -> 4K table P kpte = &P[i] (lockless) execmem_restore_rox set_memory_rox (CPA_COLLAPSE) cpa_collapse_large_pages rebuild leaf PMD flush_tlb_all pagetable_free(P) set_pte_atomic(kpte, ...) -> writes into freed P P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text. The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P. Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free.
Title		x86/mm/pat: Take cpa_lock around large-page collapse
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1aac65f3e651334259ecb2a5f5ddb81c01f02599 https://git.kernel.org/stable/c/591b6fac9df3f43522e8ff6eed8662f8b6f1a124 https://git.kernel.org/stable/c/fb97d1d6c20692e15247fa5c8b894b2325e38aee

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:10:51.612Z

Updated: 2026-09-17T16:10:51.612Z

Reserved: 2026-09-17T15:57:05.660Z

Link: CVE-2026-93066

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:00.380

Modified: 2026-09-17T17:18:00.380

Link: CVE-2026-93066

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T06:00:13Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object