UBUNTU-CVE-2026-93253: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock: warn when freeing reserved memory before memory map is initialized"), the following warning was hit when there was a "nohzfull" kernel boot parameter. Cannot free reserved memory because of deferred initialization of the memory map WARNING: mm/memblock.c:904 at freereservedarea+0xde/0xf0, CPU#0: swapper/0/0 : Call Trace: <TASK> memblockphysfree+0xcb/0x100 housekeepinginit+0x14c/0x170 startkernel+0x207/0x450 x8664startreservations+0x24/0x30 x8664startkernel+0xda/0xe0 commonstartup64+0x13e/0x141 </TASK> IOW, we shouldn't free memblock allocated memory so early in the boot process when memory map isn't fully initialized in deferredinitmemmap(). Fix it by saving the housekeeping cpumask memblock memory to be freed into a llist free list in housekeepinginit() and add a new housekeepinglateinit() helper to defer the actual freeing of memblock memory to when initcall's are being processed. The cpumask memblock memory is treated as a llistnode with the size of a "long" type which is also smallest cpumask size that can be allocated. The non-atomic version of the llist APIs are used as there is no contention. This commit depends on the presence of commit 7c2eee9c1367 ("memblock: don't touch memblock arrays when memblockfree() is called late") to prevent a KASAN UAF bug report [1]. [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 7c2eee9c1367
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is relevant to affected Ubuntu kernel packages when the system is booted with the nohz_full kernel parameter. The listed packages are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What is required to trigger the problem?
The reported condition occurs during early boot when nohz_full is configured. It involves freeing housekeeping CPU-mask memory before deferred memory-map initialization has completed.
How can I identify a potentially affected boot?
Check the kernel command line for nohz_full and review early-boot kernel logs for the warning "Cannot free reserved memory because of deferred initialization of the memory map". The trace may include memblock_phys_free, housekeeping_init, and start_kernel.
What changes in the resolved kernel behavior?
The fix defers freeing the housekeeping cpumask memblock allocation until initcalls are being processed, rather than freeing it during housekeeping initialization early in boot.