CVE-2026-99093
Received Received - Intake

Kernel Page Table Freeing Race Condition in Linux Kernel

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable_free_kernel(), which queues work on system_percpu_wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable_free_kernel() before the workqueue that function relies on exists. Keep putting the table on the list, but don't schedule the work while the system is still booting. A core_initcall schedules it once to free whatever was queued by then.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-99093
EUVD
EUVD-2026-109899

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 84e0cd79d57f06b872154eb5d8f610584133f260
Linux Linux 922873cf4fc34124215070a8ad391bf831538bb9
Linux Linux 9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4
Linux Linux 6.18.53
Linux Linux 7.2.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs during system boot when using a boot-time function tracer with a filter. It causes a kernel panic due to a general protection fault when the tracer attempts to start. The issue arises because the kernel tries to free page tables while the system is still booting, before the workqueue system is fully initialized. This leads to a null-pointer dereference and system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel and manifests during boot with certain kernel tracing configurations. Detection requires checking kernel logs for boot-time panics or crashes, particularly when using ftrace with function tracing enabled. Look for errors like 'general protection fault' or 'Kernel panic' during early boot stages.

Impact Analysis

This vulnerability can cause your Linux system to crash during boot if you are using a boot-time function tracer with a filter. The crash results in a kernel panic, making the system unbootable until the issue is resolved. It primarily affects systems running a vulnerable Linux kernel version during the boot process.

Mitigation Strategies

Apply the latest kernel patches that resolve this issue. Avoid using boot-time function tracing with filters like 'ftrace=function ftrace_filter=pud_free_pmd_page' until the patch is applied. Monitor kernel updates from your Linux distribution for fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart