CVE-2026-93237

Received Received - Intake

Memory Corruption in Linux Kernel Physical Address Handling

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add DIRECT_MAP_PHYSMEM_END definition get_free_mem_region() and mhp_get_pluggable_range() bound their search to DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is (1ULL << MAX_PHYSMEM_BITS) - 1, a compile-time constant that does not adapt to the CPU's physical address space bits (cpu_pabits, probed from CPUCFG1). The vmemmap window only covers physical space below 2^(cpu_pabits+1) (i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than MAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return a ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then wraps the memmap range around and maps it into low memory, silently corrupting the page tables. The same search also picked the top-of- address-space region that crashed memmap_init_zone_device() with amdkfd on Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 ("LoongArch/mm: align vmemmap to maximal folio size") keeps that region in bounds on current Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g. the Loongson-2K series) are still affected. Define DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range, (1ULL << (cpu_pabits + 1)) - 1, capped at (1ULL << MAX_PHYSMEM_BITS) - 1 under CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d ("riscv: mm: Define DIRECT_MAP_PHYSMEM_END"). [1] https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93237

EUVD

EUVD-2026-86243

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel on LoongArch systems. It involves a missing definition for DIRECT_MAP_PHYSMEM_END, which causes memory region searches to exceed the vmemmap window. This leads to page table corruption when the memmap range wraps around and maps into low memory.

Detection Guidance

This vulnerability is specific to the Linux kernel on LoongArch systems and does not have a direct network detection method. To check if your system is affected, verify the kernel version and LoongArch CPU type. Use commands like 'uname -a' to check the kernel version and 'cat /proc/cpuinfo' to confirm LoongArch CPU. If the kernel is older than the patched version and uses LoongArch, the system may be vulnerable.

Impact Analysis

The vulnerability can cause system crashes or memory corruption on affected LoongArch CPUs, particularly those with fewer physical address bits like the Loongson-2K series. It may also lead to data corruption or instability in systems using these CPUs.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to memory management in the Linux kernel. It may indirectly impact compliance if the memory corruption leads to data integrity issues or unauthorized access, but no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security updates or the official Linux kernel source for patches. If updating is not immediately possible, consider disabling CONFIG_SPARSEMEM_VMEMMAP or limiting usage to systems with LoongArch CPUs that have cpu_pabits equal to MAX_PHYSMEM_BITS.

Hi! I’m here to help you understand CVE-2026-93237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70