UBUNTU-CVE-2026-90201: Use After Free

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration (ethtool -L / ethtool -G) with iperf3 traffic on arm64. The race is intermittently triggered when pagepooldestroy() runs pagepoolscrub() concurrently with page return via pagepoolputnetmem() on a different CPU. A WARN in pagepoolclearppinfo() surfaced the dangling DMA index bits left by the cmpxchg loser, which led to the investigation. pagepoolscrub() iterates pool->dmamapped via xaforeach() with no page ref held. pagepoolreleasenetmemdma() currently reads and writes netmem fields (dmaaddr, DMA index bits in ppmagic) after xacmpxchg() returns. The unref path calls putpage() unconditionally regardless of the cmpxchg outcome; when it loses the cmpxchg, it still frees the page before the scrub winner finishes these netmem accesses, so scrub touches a freed page -- a Use-After-Free. Fix this by splitting the DMA release into two functions: 1. pagepoolunmapnetmemdma() caches dmaaddr before xacmpxchg(), does the cmpxchg to remove the DMA mapping, and calls dmaunmap on the cached address. It never touches netmem fields after the cmpxchg, making it safe for the scrub path which holds no page ref. 2. pagepoolreleasenetmemdma() wraps the above and additionally clears dmaaddr and DMA index bits in netmem fields. This is safe only when the caller holds a page ref, so it is used by the return path (pagepoolreturnnetmem). The scrub path calls pagepoolunmapnetmemdma() directly; the return path calls pagepoolreleasenetmemdma().