CVE-2026-93227

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone()

initializes struct pages early in boot to satisfy an allocation.

With a large CMA reservation in place, the ranges deferred_init_memmap()

finds may not add up to the allocation it was asked for, and the function

ends up initializing the memory map of the entire zone and still falls

short.

That is fine in itself: the function accounts for it and leaves the

caller to decide whether it now has enough memory.

However, the update of pgdat->first_deferred_pfn that tracks where

uninitialized memory map starts could overflow.

If the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and

some deferred struct pages were initialized, pgdat->first_deferred_pfn

would point past the end of the node's memory.

deferred_init_memmap() later picks up from pgdat->first_deferred_pfn and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References