Executive brief
The Linux kernel's memory page allocator used an unsafe spinlock operation in certain contexts involving nonmaskable interrupts (NMI) on single-processor systems. A local attacker running BPF tracing programs could crash the kernel or potentially escalate privileges.
Technical details
The vulnerability exists in mm/page_alloc.c where the free_pages_nolock() function performs a spin_trylock() operation without proper safety checks for NMI (nonmaskable interrupt) context on uniprocessor (UP/non-SMP) configurations. The root cause is that spin_trylock() is unsafe to call in NMI context according to the can_spin_trylock() function, but this restriction was only checked for CONFIG_PREEMPT_RT builds, missing the case where CONFIG_SMP is disabled. An attacker with privileges to load BPF programs (typically requiring CAP_SYS_ADMIN) and trigger NMI-context code paths can cause a kernel crash or potential privilege escalation. The fix adds an additional check to prevent spin_trylock() when both CONFIG_SMP is disabled and in_nmi() returns true.
Affected products
- Linux Linux kernel multiple versions with free_pages_nolock() (since commit 8c57b687e833)
Timeline
- 2026-09-16: disclosed: CVE-2026-90046 published on NVD
- 2026-08-06: patched: Fix merged upstream in commit 3105ae628fb785d48b49256468be4f21a7b3cfc0
- 2026-09-04: patched: Fix by Brendan Jackman authored