CVE-2026-93066

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Take cpa_lock around large-page collapse

Loading and unloading modules concurrently on several CPUs on a KASAN

build, with a short delay injected at the CPA page-table lookup to

widen the window, faults within minutes:

BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0

Write of size 8 at addr ffff888181139718 by task modprobe

...

The buggy address belongs to the physical page:

pfn:0x181139 ... page_type: f2(table)

cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and

frees the old PTE-table pages, while __change_page_attr() fetches a

PTE pointer from a lockless lookup_address_in_pgd_attr() and writes

it with set_pte_atomic() only later. When module text is served from

a shared large ROX mapping the two run on the same PMD:

CPU A (module load) CPU B (module finalize)

------------------- -----------------------

execmem_make_temp_rw

set

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References