CVE-2026-99093— mm: don't schedule deferred kernel page table freeing while booting

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： mm：在系统启动期间，不要安排延迟的内核页表释放操作当使用启动时函数追踪器（boot-time function tracer）并配合过滤器（例如：）进行启动时，在 7.3-rc4 版本中，一旦追踪器开始运行，系统就会立即发生内核恐慌（panic）：问题原因分析：启动时的追踪器由函数启动，该函数在之前执行。当将追踪器的跳板（trampoline）设置为只读时，会触发大页（large page）的分裂（split），而紧接着 CPA（Change Page At

AI Predicted 5.5 Difficulty: Moderate Updated Oct 26, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1053 · Scheduled Task/Job T1069 · Permission Groups Discovery

Updated Oct 26, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mm: don't schedule deferred kernel page table freeing while booting

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable_free_kernel(), which queues work on system_percpu_wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable_free_kernel() before the workqueue that function relies on exists. Keep putting the table on the list, but don't schedule the work while the system is still booting. A core_initcall schedules it once to free whatever was queued by then.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	84e0cd79d57f06b872154eb5d8f610584133f260 ~ 7a25ca170c12a9328f6fcf4410713beb516b01c0	-
Linux	Linux	6.18.53 ~ 6.18.57	-

II. Public POCs for CVE-2026-99093

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99093

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99093 (2)

https://www.cve.org/CVERecord?id=CVE-2026-99093

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099		x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097		tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99098		dm-integrity: fix buffer overflow in inline mode with large tag size
CVE-2026-99095		drm/vc4: drain the hangcheck timer and works on V3D unbind
CVE-2026-99096		io_uring/register: don't exempt disabled rings from task restrictions
CVE-2026-99094		Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99092		riscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99090		drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99091		Bluetooth: MGMT: Fix status of pending commands flushed on power off
CVE-2026-99089		ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088		net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux