Executive brief
The Linux kernel's SGI GRU (Graphics Reconfigurable Unit) driver contains a race condition in its TLB (Translation Lookaside Buffer) miss handler that walks page tables without holding proper locks. An attacker with local access could exploit this to cause a denial of service or potentially leak kernel memory by triggering faults while page tables are being modified concurrently.
Technical details
The vulnerability exists in the GRU TLB miss handler (drivers/misc/sgi-gru/grufault.c), which performs page table walks in interrupt context without holding page-table locks or maintaining a reference to the mapped page. The atomic_pte_lookup() function walks user page tables using kernel page-table accessors and only supports PMD-level large mappings on x86-64, creating race conditions when pages are unmapped or remapped concurrently. An attacker can trigger page faults that force the handler to perform unsynchronized page table traversals, potentially leading to use-after-free or NULL pointer dereference conditions. The fix removes the interrupt-context walker and defers all page table lookups to process context where proper locking can be held. The vulnerability requires local code execution capability and affects systems with GRU hardware support compiled in.
Affected products
- Linux Linux kernel multiple versions (see stable kernel tree branches)
Timeline
- 2026-09-17: disclosed
- 2026-07-30: patched