Executive brief
A race condition in the Linux kernel's page-table management (PAT subsystem) can cause memory corruption when modules are loaded and unloaded concurrently. An attacker with the ability to load kernel modules could potentially crash the system or cause unpredictable behavior by triggering this use-after-free condition during concurrent module operations.
Technical details
The vulnerability is a use-after-free race condition in x86/mm/pat.c where cpa_collapse_large_pages() rebuilds page-table entries and frees the underlying page-table page, while a concurrent __change_page_attr() call holds a stale pointer to that freed page from a lockless lookup_address_in_pgd_attr(). The attacker can trigger this by loading/unloading kernel modules concurrently on multiple CPUs, causing the two code paths to race on the same PMD. The __change_page_attr() walker runs with interrupts enabled, so a TLB flush does not serialize against it. The fix adds cpa_lock protection around the collapse operation (PMD rebuild, TLB flush, and page free) to serialize against concurrent walkers.
Affected products
- Linux Linux kernel unknown
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched