CVE-2026-93066
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: Take cpa_lock around large-page collapse
Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:
cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD:
Leer descripción completaMostrar menos
P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text.
The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P.
Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free.
Detalles técnicos trazas, registros y código del informe original
BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
Write of size 8 at addr ffff888181139718 by task modprobe
...
The buggy address belongs to the physical page:
pfn:0x181139 ... page_type: f2(table)
CPU A (module load) CPU B (module finalize)
------------------- -----------------------
execmem_make_temp_rw
set_memory_nx
__change_page_attr
split 2M -> 4K table P
kpte = &P[i] (lockless)
execmem_restore_rox
set_memory_rox (CPA_COLLAPSE)
cpa_collapse_large_pages
rebuild leaf PMD
flush_tlb_all
pagetable_free(P)
set_pte_atomic(kpte, ...)
-> writes into freed PCVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-93066",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"lessThan": "591b6fac9df3f43522e8ff6eed8662f8b6f1a124",
"versionType": "git"
},
{
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"lessThan": "fb97d1d6c20692e15247fa5c8b894b2325e38aee",
"versionType": "git"
},
{
"status": "affected",
"version": "41d88484c71cd4f659348da41b7b5b3dbd3be1f6",
"lessThan": "1aac65f3e651334259ecb2a5f5ddb81c01f02599",
"versionType": "git"
}
],
"programFiles": [
"arch/x86/mm/pat/set_memory.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/mm/pat/set_memory.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-17T17:18:00.380",
"references": [
{
"url": "https://git.kernel.org/stable/c/1aac65f3e651334259ecb2a5f5ddb81c01f02599",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/591b6fac9df3f43522e8ff6eed8662f8b6f1a124",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fb97d1d6c20692e15247fa5c8b894b2325e38aee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Take cpa_lock around large-page collapse\n\nLoading and unloading modules concurrently on several CPUs on a KASAN\nbuild, with a short delay injected at the CPA page-table lookup to\nwiden the window, faults within minutes:\n\n BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0\n Write of size 8 at addr ffff888181139718 by task modprobe\n ...\n The buggy address belongs to the physical page:\n pfn:0x181139 ... page_type: f2(table)\n\ncpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and\nfrees the old PTE-table pages, while __change_page_attr() fetches a\nPTE pointer from a lockless lookup_address_in_pgd_attr() and writes\nit with set_pte_atomic() only later. When module text is served from\na shared large ROX mapping the two run on the same PMD:\n\n CPU A (module load) CPU B (module finalize)\n ------------------- -----------------------\n execmem_make_temp_rw\n set_memory_nx\n __change_page_attr\n split 2M -> 4K table P\n kpte = &P[i] (lockless)\n execmem_restore_rox\n set_memory_rox (CPA_COLLAPSE)\n cpa_collapse_large_pages\n rebuild leaf PMD\n flush_tlb_all\n pagetable_free(P)\n set_pte_atomic(kpte, ...)\n -> writes into freed P\n\nP is a page-table page (page_type: table), reused at once, so the\nwrite corrupts whatever got the page next: a bad-pte or bad-page\nsplat, or a fatal fault once P has been turned into read-only text.\n\nThe flush_tlb_all() before the free does not close this: its IPI only\nserializes against page-table walkers that run with interrupts off\n(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts\non, so nothing stops it from holding a stale pointer into P.\n\nSerialize the collapse - the PMD rebuild, TLB flush and PTE-table\nfree - under cpa_lock, the same lock __change_page_attr() now takes\nunconditionally since commit (\"x86/mm/pat: stop gating cpa_lock on\ndebug_pagealloc_enabled()\"), so a concurrent walker can no longer\nhold a pointer into a table the collapse is about to free."
}
],
"lastModified": "2026-09-17T17:18:00.380",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}