CVE-2026-99093: mm: don't schedule deferred kernel page table freeing while booting

In the Linux kernel, the following vulnerability has been resolved:

mm: don't schedule deferred kernel page table freeing while booting

Booting with a boot-time function tracer and a filter, for example

ftrace=function ftracefilter=pudfreepmdpage

panics on 7.3-rc4 as soon as the tracer starts:

[ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:queuework+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetablefreekernel+0x20/0x120 [ 26.990283] queueworkon+0x97/0xf0 [ 27.134382] cpacollapselargepages+0x501/0x6f0 [ 27.566662] cpaflush+0x394/0x620 [ 27.998953] changepageattrsetclr+0x321/0x4a0 [ 29.151729] setmemoryrox+0xa2/0xf0 [ 29.584018] createtrampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!

The boot-time tracer is started from earlytraceinit(), which runs before workqueueinitearly(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetablefreekernel(), which queues work on systempercpuwq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetablefreekernel() before the workqueue that function relies on exists.

Keep putting the table on the list, but don't schedule the work while the system is still booting. A coreinitcall schedules it once to free whatever was queued by then.