Look up another CVE · open CVE-2026-97525 in the interactive tracker
CVE-2026-97525
x86/mm/pat: Allocate split page tables as kernel page tables
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem arch/x86. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-97525 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A PTE is allocated directly without going through the standard page table allocation routines (such as pte_alloc_one_kernel()) when the CPA code splits a large page (__split_large_page()). This means the page table constructor is never called nor is the page table marked as a kernel page table. The former results in the folio associated with the page table not being marked as a page table (__pagetable_ctor() is never called thus neither is __folio_set_pgtable()) nor are statistics updated to reflect it (lruvec_stat_add_folio() is never called). The latter issue of failing to mark the page table as a kernel page table (ptdesc_set_kernel() is never called) is far more problematic. Since commit: 5ba2f0a15564 ("mm: introduce deferred freeing for kernel page tables") kernel page table freeing has been batched and since the subsequent commit: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space") IOTLB cache entries for kernel page tables have been invalidated upon being freed. Since split page tables are freed without this invalidation, the IOTLB can contain stale entries for them. Resolve the issue by using the ordinary PTE allocation API at split time. This results in these kernel page tables invoking a page table constructor, and thus requires a page table destructor. Destructors are not always present, like for early allocated direct map page tables). Conditionally call pagetable_dtor_free() if the PG_table folio flag for the ptdesc is set, otherwise we free the page table via pagetable_free(). Regardless of which path is taken page tables marked as kernel page tables, which now includes split page tables, take the correct route through pagetable_free_kernel(). There is a user-visible side effect in that split page tables will appear in nr_page_table_pages in /proc/vmstat (as do other kernel page tables allocated after early boot), however this is a positive change. This issue started being markedly problematic after commit: 5ba2f0a15564 ("mm: introduce deferred freeing for kernel page tables") so choose this as the Fixes target. [ dhansen: rephrase in imperative mood ]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/x86/mm/pat/set_memory.c
- What this is
- X86 MMMAINTAINERS section matched on arch/x86/mm/ · linux-kernel@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 8.2 high
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/x86
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.18.7 | 6.18.53 | 84e0cd79d57f |
| 6.19 | 7.2.7 | 922873cf4fc3 |
| 6.19 | 7.3 | 9e4a3ec3411b |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- split_large_page() is reached from local set_memory_* via change_page_attr_set_clr()→__change_page_attr(); the path that allocates unmarked tables and later frees them is finit_module→module_memory_alloc()→execmem_alloc_rw()→execmem_force_rw()/set_memory_nx (split) then module_enable_text_rox()→set_memory_rox() (collapse). No remote protocol carries the input.
- AC:LAttack complexity, low
- On an x86 IOMMU_SVA host, a module whose text is carved from the execmem ROX 2M cache makes execmem_force_rw() split that PMD (pagetable_alloc without ptdesc_set_kernel) and set_memory_rox(CPA_COLLAPSE) free it in cpa_collapse_large_pages(); the same caller binds SVA, primes IOTLB walks, and sprays reuse without an uncontrolled race.
- PR:HPrivileges required, high
- may_init_module() requires capable(CAP_SYS_MODULE) in init_user_ns, which user namespaces cannot grant. Only EXECMEM_MODULE_TEXT with EXECMEM_ROX_CACHE both splits a huge mapping in split_large_page() and collapse-frees it; EXECMEM_BPF lacks ROX_CACHE so unprivileged bpf_jit_alloc_exec()/set_memory_rox does not produce these unmarked tables.
- UI:NUser interaction, none
- The attacker issues their own init_module/finit_module (and optional delete_module) against a module they supply; no other user must mount an image, open a file, or bind a device on their behalf.
- S:CScope, changed
- cpa_collapse_large_pages() calls pagetable_free() on the PTE table split_large_page() allocated without ptdesc_set_kernel(), so ptdesc_test_kernel() is false and pagetable_free_kernel() never runs iommu_sva_invalidate_kva_range(); a PASID SVA walk can treat the reused page as IOMMU translations, crossing the IOMMU DMA isolation boundary.
- C:HConfidentiality impact, high
- A stale IOTLB paging-structure cache entry for the freed split table lets the IOMMU interpret attacker-controlled reused page contents as PTEs, enabling arbitrary physical-memory DMA reads of kernel or other-process data.
- I:HIntegrity impact, high
- The same stale IOTLB walk enables arbitrary physical-memory DMA writes, and the IOMMU may write Accessed and Dirty bits into the recycled page while walking it, a write-after-free of the unmarked CPA table.
- A:HAvailability impact, high
- Arbitrary DMA writes into reused memory and IOTLB write-after-free of the page cpa_collapse_large_pages() passed to pagetable_free() can corrupt kernel or page-table state, causing an oops, panic, or hang.