{"id":"CVE-2026-93239","state":"PUBLISHED","title":"arm64: mm: Fix the lockless page-table walk in show_pte()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix the lockless page-table walk in show_pte()\n\nshow_pte() walks page tables locklessly and can run with interrupts\nenabled. A concurrent teardown can free a table page while it is being\nwalked. It can also clear a parent entry after show_pte() checked it; the\nregular pXd_offset() helpers then reread the cleared entry and can derive a\nbogus lower-level pointer and fault again.\n\nUse the lockless offset helpers with the saved parent entries, as\ngup_fast() does, and pass the saved PMD to pte_offset_map().\n\nFor task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable\nlocal interrupts around the walk to hold off RCU-deferred table frees and\nblock the tlb_remove_table_sync_one() IPI until the walk is finished.\n\nPlace the IRQ guard after the header print. This does not make the output a\nconsistent snapshot, but prevents the task page-table walk from\ndereferencing a released table page or deriving a pointer from a different\nparent value.","publishedAt":"2026-09-24T15:34:27.219Z","updatedAt":"2026-10-30T12:36:29.121Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b8f06b73ad146d84a33c124563c93eeef4f5b674","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b3535b6cb2c48f97b8c3378eb9ea12538425bf14","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"e1b06278a7e241da0cd3187871e67255f956d184","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"08d931a0a850ad16a64f2cd23a19f40795cdbdf7","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"a77644d009dece1104b6fcc6e322b0e4503db0d6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/mm/fault.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/mm/fault.c"]}],"references":["https://git.kernel.org/stable/c/b8f06b73ad146d84a33c124563c93eeef4f5b674","https://git.kernel.org/stable/c/b3535b6cb2c48f97b8c3378eb9ea12538425bf14","https://git.kernel.org/stable/c/e1b06278a7e241da0cd3187871e67255f956d184","https://git.kernel.org/stable/c/08d931a0a850ad16a64f2cd23a19f40795cdbdf7","https://git.kernel.org/stable/c/b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","https://git.kernel.org/stable/c/68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","https://git.kernel.org/stable/c/0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","https://git.kernel.org/stable/c/a77644d009dece1104b6fcc6e322b0e4503db0d6"],"weaknesses":[],"ingestedAt":"2026-10-30T12:56:04.490Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93239.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93239","state":"PUBLISHED","datePublished":"2026-09-24T15:34:27.219Z","dateUpdated":"2026-10-30T12:36:29.121Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-17T16:02:15.095Z"},"containers":{"cna":{"title":"arm64: mm: Fix the lockless page-table walk in show_pte()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix the lockless page-table walk in show_pte()\n\nshow_pte() walks page tables locklessly and can run with interrupts\nenabled. A concurrent teardown can free a table page while it is being\nwalked. It can also clear a parent entry after show_pte() checked it; the\nregular pXd_offset() helpers then reread the cleared entry and can derive a\nbogus lower-level pointer and fault again.\n\nUse the lockless offset helpers with the saved parent entries, as\ngup_fast() does, and pass the saved PMD to pte_offset_map().\n\nFor task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable\nlocal interrupts around the walk to hold off RCU-deferred table frees and\nblock the tlb_remove_table_sync_one() IPI until the walk is finished.\n\nPlace the IRQ guard after the header print. This does not make the output a\nconsistent snapshot, but prevents the task page-table walk from\ndereferencing a released table page or deriving a pointer from a different\nparent value."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b8f06b73ad146d84a33c124563c93eeef4f5b674","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b3535b6cb2c48f97b8c3378eb9ea12538425bf14","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"e1b06278a7e241da0cd3187871e67255f956d184","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"08d931a0a850ad16a64f2cd23a19f40795cdbdf7","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","versionType":"git"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","status":"affected","lessThan":"a77644d009dece1104b6fcc6e322b0e4503db0d6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/mm/fault.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/mm/fault.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b8f06b73ad146d84a33c124563c93eeef4f5b674"},{"url":"https://git.kernel.org/stable/c/b3535b6cb2c48f97b8c3378eb9ea12538425bf14"},{"url":"https://git.kernel.org/stable/c/e1b06278a7e241da0cd3187871e67255f956d184"},{"url":"https://git.kernel.org/stable/c/08d931a0a850ad16a64f2cd23a19f40795cdbdf7"},{"url":"https://git.kernel.org/stable/c/b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1"},{"url":"https://git.kernel.org/stable/c/68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3"},{"url":"https://git.kernel.org/stable/c/0f05d95b99164a9ccc4cf4a4920e0ff0228138ad"},{"url":"https://git.kernel.org/stable/c/a77644d009dece1104b6fcc6e322b0e4503db0d6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:36:29.121Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}