CVE-2026-90201

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race

This bug was discovered while testing the hns3 driver under channel

reconfiguration (`ethtool -L` / `ethtool -G`) with iperf3 traffic on

arm64. The race is intermittently triggered when page_pool_destroy()

runs page_pool_scrub() concurrently with page return via

page_pool_put_netmem() on a different CPU. A WARN in

page_pool_clear_pp_info() surfaced the dangling DMA index bits left

by the cmpxchg loser, which led to the investigation.

page_pool_scrub() iterates pool->dma_mapped via xa_for_each() with no

page ref held. __page_pool_release_netmem_dma() currently reads and

writes netmem fields (dma_addr, DMA index bits in pp_magic) after

xa_cmpxchg() returns. The unref path calls put_page() unconditionally

regardless of the cmpxchg outcome; when it loses the cmpxchg, it still

frees the page before the scrub winner finishes these netmem accesses

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References