Executive brief
The Linux kernel had a race condition in memory management where concurrent operations to promote virtual memory mappings to large page table entries could free page tables while kernel debugging tools were still reading them, potentially causing system instability or crashes. This fix ensures proper synchronization between these operations to prevent the system from accessing freed memory.
Technical details
The vulnerability is a use-after-free (UAF) bug in the kernel's memory management subsystem, specifically in the vmalloc page table handling (mm/vmalloc). The root cause is a race condition between vmap page table huge promotion logic and ptdump (page table dump) walkers. When vmap promotes page tables to huge leaf entries, it frees the lower page table entries without holding locks that would exclude concurrent ptdump walks. ptdump walks kernel page tables that it does not own, and can observe freed page tables. The fix acquires the init_mm mmap read lock during vmap huge promotion and page table freeing, while ptdump already holds the write lock, ensuring serialization. The issue is local to kernel memory management operations and does not have a direct network attack vector. Related fixes are also applied to CPA (Change Page Attributes) logic on x86 for the same UAF pattern.
Affected products
- Linux Linux Kernel affected versions prior to fix
Timeline
- 2026-08-22: disclosed