CVE-2026-99093

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99093", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.390Z", "datePublished": "2026-10-26T14:52:01.450Z", "dateUpdated": "2026-10-26T14:52:01.450Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T14:52:01.450Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: don't schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n ftrace=function ftrace_filter=pud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n [ 23.531178] Starting tracer 'function'\n [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00\n [ 25.981629] Call Trace:\n [ 26.125727] <TASK>\n [ 26.413912] ? pagetable_free_kernel+0x20/0x120\n [ 26.990283] queue_work_on+0x97/0xf0\n [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0\n [ 27.566662] cpa_flush+0x394/0x620\n [ 27.998953] change_page_attr_set_clr+0x321/0x4a0\n [ 29.151729] set_memory_rox+0xa2/0xf0\n [ 29.584018] create_trampoline+0x431/0x6f0\n ...\n [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\n\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early(). Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away. The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point. That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\n\nKeep putting the table on the list, but don't schedule the work while\nthe system is still booting. A core_initcall schedules it once to free\nwhatever was queued by then."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/pgtable-generic.c"], "versions": [{"version": "84e0cd79d57f06b872154eb5d8f610584133f260", "lessThan": "7a25ca170c12a9328f6fcf4410713beb516b01c0", "status": "affected", "versionType": "git"}, {"version": "922873cf4fc34124215070a8ad391bf831538bb9", "lessThan": "df6c704a08bc0925d5db047b0a6221f962bda4d9", "status": "affected", "versionType": "git"}, {"version": "9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4", "lessThan": "2fb552b0bee70c24c092720028ab4620f5eb2646", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/pgtable-generic.c"], "versions": [{"version": "6.18.53", "lessThan": "6.18.57", "status": "affected", "versionType": "semver"}, {"version": "7.2.7", "lessThan": "7.2.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.53", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.7", "versionEndExcluding": "7.2.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7a25ca170c12a9328f6fcf4410713beb516b01c0"}, {"url": "https://git.kernel.org/stable/c/df6c704a08bc0925d5db047b0a6221f962bda4d9"}, {"url": "https://git.kernel.org/stable/c/2fb552b0bee70c24c092720028ab4620f5eb2646"}], "title": "mm: don't schedule deferred kernel page table freeing while booting", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/pgtable-generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7a25ca170c12a9328f6fcf4410713beb516b01c0", "status": "affected", "version": "84e0cd79d57f06b872154eb5d8f610584133f260", "versionType": "git"}, {"lessThan": "df6c704a08bc0925d5db047b0a6221f962bda4d9", "status": "affected", "version": "922873cf4fc34124215070a8ad391bf831538bb9", "versionType": "git"}, {"lessThan": "2fb552b0bee70c24c092720028ab4620f5eb2646", "status": "affected", "version": "9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/pgtable-generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.18.57", "status": "affected", "version": "6.18.53", "versionType": "semver"}, {"lessThan": "7.2.11", "status": "affected", "version": "7.2.7", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: don't schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n ftrace=function ftrace_filter=pud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n [ 23.531178] Starting tracer 'function'\n [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00\n [ 25.981629] Call Trace:\n [ 26.125727] <TASK>\n [ 26.413912] ? pagetable_free_kernel+0x20/0x120\n [ 26.990283] queue_work_on+0x97/0xf0\n [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0\n [ 27.566662] cpa_flush+0x394/0x620\n [ 27.998953] change_page_attr_set_clr+0x321/0x4a0\n [ 29.151729] set_memory_rox+0xa2/0xf0\n [ 29.584018] create_trampoline+0x431/0x6f0\n ...\n [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\n\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early(). Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away. The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point. That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\n\nKeep putting the table on the list, but don't schedule the work while\nthe system is still booting. A core_initcall schedules it once to free\nwhatever was queued by then."}], "id": "CVE-2026-99093", "lastModified": "2026-10-26T15:16:48.253", "metrics": {}, "published": "2026-10-26T15:16:48.253", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fb552b0bee70c24c092720028ab4620f5eb2646"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a25ca170c12a9328f6fcf4410713beb516b01c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df6c704a08bc0925d5db047b0a6221f962bda4d9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mm: don't schedule deferred kernel page table freeing while booting", "id": "2560871", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560871"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: don't schedule deferred kernel page table freeing while booting\nBooting with a boot-time function tracer and a filter, for example\nftrace=function ftrace_filter=pud_free_pmd_page\npanics on 7.3-rc4 as soon as the tracer starts:\n[ 23.531178] Starting tracer 'function'\n[ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n[ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n[ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n[ 24.252248] RIP: 0010:__queue_work+0xab/0xf00\n[ 25.981629] Call Trace:\n[ 26.125727] <TASK>\n[ 26.413912] ? pagetable_free_kernel+0x20/0x120\n[ 26.990283] queue_work_on+0x97/0xf0\n[ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0\n[ 27.566662] cpa_flush+0x394/0x620\n[ 27.998953] change_page_attr_set_clr+0x321/0x4a0\n[ 29.151729] set_memory_rox+0xa2/0xf0\n[ 29.584018] create_trampoline+0x431/0x6f0\n...\n[ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early(). Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away. The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point. That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\nKeep putting the table on the list, but don't schedule the work while\nthe system is still booting. A core_initcall schedules it once to free\nwhatever was queued by then.", "A flaw was found in the Linux kernel. A privileged user capable of modifying boot parameters can cause a Denial of Service (DoS) by enabling early boot function tracing. Under this configuration, the kernel attempts to schedule deferred page table memory cleanup before necessary internal work services are initialized, triggering a null pointer dereference that crashes the system during startup."], "name": "CVE-2026-99093", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99093\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99093\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99093.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84e0cd79d57f06b872154eb5d8f610584133f260,7a25ca170c12a9328f6fcf4410713beb516b01c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[922873cf4fc34124215070a8ad391bf831538bb9,df6c704a08bc0925d5db047b0a6221f962bda4d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4,2fb552b0bee70c24c092720028ab4620f5eb2646)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.53,6.18.57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.7,7.2.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84e0cd79d57f06b872154eb5d8f610584133f260,7a25ca170c12a9328f6fcf4410713beb516b01c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[922873cf4fc34124215070a8ad391bf831538bb9,df6c704a08bc0925d5db047b0a6221f962bda4d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4,2fb552b0bee70c24c092720028ab4620f5eb2646)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.53,6.18.57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.7,7.2.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-26T16:45:14.918090+00:00", "updated": "2026-10-29T19:30:16.315602+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}