CVE-2026-93239: arm64: mm: Fix the lockless page-table walk in show_pte()
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: Fix the lockless page-table walk in showpte()
showpte() walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent entry after showpte() checked it; the regular pXdoffset() helpers then reread the cleared entry and can derive a bogus lower-level pointer and fault again.
Use the lockless offset helpers with the saved parent entries, as gupfast() does, and pass the saved PMD to pteoffsetmap().
For task page tables, arm64 selects MMUGATHERRCUTABLEFREE. Disable local interrupts around the walk to hold off RCU-deferred table frees and block the tlbremovetablesyncone() IPI until the walk is finished.
Place the IRQ guard after the header print. This does not make the output a consistent snapshot, but prevents the task page-table walk from dereferencing a released table page or deriving a pointer from a different parent value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable MMU_GATHER_RCU_TABLE_FREE for task page tables.
arm64 task page tables MMU_GATHER_RCU_TABLE_FREE = disabled
Event History
Frequently Asked Questions
When can this race be triggered?
It requires show_pte() to walk task page tables while another context concurrently tears down those page tables. The walk runs locklessly with interrupts enabled, allowing a table page to be freed or a parent entry to change during traversal.
What is the practical impact of the race?
show_pte() can dereference a released page-table page or derive a lower-level page-table pointer from a parent entry that has since been cleared. This can cause another fault during the diagnostic page-table walk.
Does the fix make show_pte() output a consistent page-table snapshot?
No. The change prevents dereferences of released table pages and pointers derived from changed parent entries, but the output can still reflect concurrent page-table changes.
What protection does the fix add for task page tables?
It uses lockless offset helpers with saved parent entries and passes the saved PMD to pte_offset_map(). It also disables local interrupts during the walk so RCU-deferred table frees and the relevant TLB synchronization IPI cannot complete until the walk finishes.