CVE-2026-97942: x86/alternatives: Exclude text poking against change_page_attr()
In the Linux kernel, the following vulnerability has been resolved:
x86/alternatives: Exclude text poking against changepageattr()
From time to time, the following BUG can be observed in the x86 alternatives patching code [0]:
> kernel BUG at arch/x86/kernel/alternative.c:2576! > Oops: invalid opcode: 0000 [#1] SMP NOPTI > CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 > RIP: 0010:textpoke+0x2aa/0x450 > Call Trace: > <TASK> > smptextpokebatchfinish+0x2a7/0x320 > staticcalltransform+0xb7/0x220 > archstaticcalltransform+0x5b/0xb0 > staticcallinit+0xe9/0x270 > staticcallmodulenotify+0x11f/0x150 > notifiercallchain+0x61/0xe0 > blockingnotifiercallchainrobust+0x63/0xc0 > loadmodule+0x1c92/0x20c0 > initmodulefromfile+0xd8/0x140 > idempotentinitmodule+0x100/0x2f0 > x64sysfinitmodule+0x71/0xe0 > dosyscall64+0xe1/0x610 > entrySYSCALL64afterhwframe+0x76/0x7e
which matches the following BUGON() in alternative.c:
/ If something went wrong, crash and burn since recovery paths are not implemented. / BUGON(!pages[0] || (crosspageboundary && !pages[1]));
This can happen if vmalloctopage() fails, for any reason. Such can happen if text poking races with CPA, which can possibly result in the collapsing of page tables (or breaking of PMD hugepages). It is not a problem for most users of vmalloctopage() (they solely own the vmalloc'd range) but, when CONFIGARCHHASEXECMEMROX=y, various modules own a single execmem vmalloc range, and can call setmemory() in parallel on it. This can happen to race against textpoke and cause havoc in vmalloctopage().
Fix it by excluding against CPA using the initmm mmap read lock.
[ dhansen: Fix up SoB ordering. The actual code flow here was: Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain now. I believe Mike simply picked up Lorenzo's update to Pedro's post from the Link ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Exclude x86 text poking from concurrent change_page_attr() (CPA) operations by using the init_mm mmap read lock.
Event History
Frequently Asked Questions
Which systems are in scope?
The issue is in the Linux kernel’s x86 alternatives patching code, so it applies to affected Linux kernel deployments on x86 systems.
How can this issue present in an affected system?
It can trigger a kernel BUG with an invalid-opcode Oops in __text_poke. The reported call trace occurred during module loading, through static-call initialization and text-poke batching.
What should be done if the affected kernel is in use?
Update to a Linux kernel build that includes the resolution. The provided stable kernel references identify commits 281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d, 89c60435b90d32ab5e3a39da3ae73d463d07debe, and 1587d3394e254639cc36516256031334095e6ef3.