CVE-2026-90303: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9485/1: mm: acquire mmap write lock around showpte() for user faults

When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while showpte() is still traversing them, causing a use-after-free in showpte().

If CONFIGARMLPAE=y, this may cause a kernel panic if the pages table of PMD are freed when showpte() is running.

Acquire mmapwritelock() around showpte() for user faults to fix the contention.

For user faults, additionally restrict that showpte() is called only when the addr is a user-space address (addr < TASKSIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications.

Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

The affected path requires an ARM Linux kernel built with CONFIG_DEBUG_USER=y and booted with the user_debug=31 command-line setting. The reported panic scenario additionally applies when CONFIG_ARM_LPAE=y.

2

What conditions are needed to trigger the use-after-free?

A user fault must cause show_pte() to traverse page tables while another thread in the same process concurrently calls munmap(). The concurrent unmap can free page-table pages that show_pte() is still accessing.

3

Are default kernel configurations affected?

The vulnerable behavior depends on the debug-specific CONFIG_DEBUG_USER configuration and the explicit user_debug=31 boot parameter. The supplied information does not indicate that these are enabled by default.

4

What is the practical impact on ARM systems using LPAE?

If CONFIG_ARM_LPAE=y, freeing PMD page-table pages during show_pte() traversal may cause a kernel panic.

5

What mitigation is available if the fix cannot be deployed immediately?

Avoid enabling CONFIG_DEBUG_USER with the user_debug=31 command-line setting on affected ARM systems. This prevents the described user-fault show_pte() path from being triggered.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203