Executive brief
A race condition was identified in the Linux kernel's User-Mode Linux (UML) architecture during memory management operations. This flaw could potentially allow a local user to cause system instability or crashes by triggering simultaneous updates to memory mapping tables. The issue affects systems running specific configurations of the Linux kernel where multi-processor support is enabled for virtualized environments.
Technical details
A race condition exists in the User-Mode Linux (UML) architecture within the `um_tlb_sync` function in `arch/um/kernel/tlb.c`. The vulnerability stems from the kernel failing to hold the page table lock while traversing and modifying page tables during Translation Lookaside Buffer (TLB) synchronization. An attacker with local access could potentially exploit this race condition to cause memory corruption or a kernel panic. The fix involves ensuring the `page_table_lock` is held during synchronization and disabling the split page table lock for UML configurations to simplify synchronization requirements.
Affected products
- Linux Linux 6.19 to 7.0.10, 7.1
Timeline
- 2026-03-03: other: Patch authored
- 2026-06-24: disclosed: CVE published