« Volver al listado

CVE-2026-97525

Estado: RecibidaAlta (8.2)—

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Allocate split page tables as kernel page tables

A PTE is allocated directly without going through the standard page table allocation routines (such as pte_alloc_one_kernel()) when the CPA code splits a large page (__split_large_page()).

This means the page table constructor is never called nor is the page table marked as a kernel page table.

The former results in the folio associated with the page table not being marked as a page table (__pagetable_ctor() is never called thus neither is __folio_set_pgtable()) nor are statistics updated to reflect it (lruvec_stat_add_folio() is never called).

Leer descripción completaMostrar menos

The latter issue of failing to mark the page table as a kernel page table (ptdesc_set_kernel() is never called) is far more problematic.

Since commit:

kernel page table freeing has been batched and since the subsequent commit:

IOTLB cache entries for kernel page tables have been invalidated upon being freed.

Since split page tables are freed without this invalidation, the IOTLB can contain stale entries for them.

Resolve the issue by using the ordinary PTE allocation API at split time.

This results in these kernel page tables invoking a page table constructor, and thus requires a page table destructor.

Destructors are not always present, like for early allocated direct map page tables). Conditionally call pagetable_dtor_free() if the PG_table folio flag for the ptdesc is set, otherwise we free the page table via pagetable_free().

Regardless of which path is taken page tables marked as kernel page tables, which now includes split page tables, take the correct route through pagetable_free_kernel().

There is a user-visible side effect in that split page tables will appear in nr_page_table_pages in /proc/vmstat (as do other kernel page tables allocated after early boot), however this is a positive change.

This issue started being markedly problematic after commit:

so choose this as the Fixes target.

[ dhansen: rephrase in imperative mood ]

Detalles técnicos trazas, registros y código del informe original
  5ba2f0a15564 ("mm: introduce deferred freeing for kernel page tables")

  e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space")

  5ba2f0a15564 ("mm: introduce deferred freeing for kernel page tables")

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local en kernel Linux (AV:L, PR:H) que permite escalada de privilegios mediante tablas de páginas no invalidadas. IOTLB con entradas stales puede causar DoS o corrupción de memoria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97525",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b3039c526f3e1744db0cbb7ae1f0213f5e27d3f4",
              "lessThan": "84e0cd79d57f06b872154eb5d8f610584133f260",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ba2f0a1556479638ac11a3c201421f5515e89f5",
              "lessThan": "922873cf4fc34124215070a8ad391bf831538bb9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ba2f0a1556479638ac11a3c201421f5515e89f5",
              "lessThan": "9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.18.7",
              "lessThan": "6.18.53",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "arch/x86/mm/pat/set_memory.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/mm/pat/set_memory.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:02.647",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/84e0cd79d57f06b872154eb5d8f610584133f260",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/922873cf4fc34124215070a8ad391bf831538bb9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Allocate split page tables as kernel page tables\n\nA PTE is allocated directly without going through the standard page table\nallocation routines (such as pte_alloc_one_kernel()) when the CPA code\nsplits a large page (__split_large_page()).\n\nThis means the page table constructor is never called nor is the page table\nmarked as a kernel page table.\n\nThe former results in the folio associated with the page table not being\nmarked as a page table (__pagetable_ctor() is never called thus neither is\n__folio_set_pgtable()) nor are statistics updated to reflect\nit (lruvec_stat_add_folio() is never called).\n\nThe latter issue of failing to mark the page table as a kernel page\ntable (ptdesc_set_kernel() is never called) is far more problematic.\n\nSince commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nkernel page table freeing has been batched and since the\nsubsequent commit:\n\n  e37d5a2d60a3 (\"iommu/sva: invalidate stale IOTLB entries for kernel address space\")\n\nIOTLB cache entries for kernel page tables have been invalidated upon\nbeing freed.\n\nSince split page tables are freed without this invalidation, the IOTLB\ncan contain stale entries for them.\n\nResolve the issue by using the ordinary PTE allocation API at split time.\n\nThis results in these kernel page tables invoking a page table constructor,\nand thus requires a page table destructor.\n\nDestructors are not always present, like for early allocated direct map\npage tables). Conditionally call pagetable_dtor_free() if the PG_table\nfolio flag for the ptdesc is set, otherwise we free the page table via\npagetable_free().\n\nRegardless of which path is taken page tables marked as kernel page tables,\nwhich now includes split page tables, take the correct route through\npagetable_free_kernel().\n\nThere is a user-visible side effect in that split page tables will appear\nin nr_page_table_pages in /proc/vmstat (as do other kernel page tables\nallocated after early boot), however this is a positive change.\n\nThis issue started being markedly problematic after commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nso choose this as the Fixes target.\n\n[ dhansen: rephrase in imperative mood ]"
    }
  ],
  "lastModified": "2026-09-25T15:17:57.917",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}