CVE-2026-97943

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

x86 implements page attribute modification using its Change Page

Attributes (CPA) mechanism.

This tracks properties of ranges such as cache mode through x86 page

attributes, and as part of that logic manipulates kernel page tables.

Since commit:

41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation")

ranges of kernel page table entries can be collapsed into

huge page table entries as part of this logic.

As part of this collapse, it frees the page tables which the collapsed

entries previously pointed to, and it does so without any relevant locks

being held to preclude concurrent kernel page table walkers.

The only way this code can be reached is if CPA_COLLAPSE is specified, and

this is only set in set_memory_rox() via:

set_memory_rox()

-> change_page_attr_set_clr()

-> cpa_flush()

-> cpa_collapse_large_pages()

Notable users of t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References