UBUNTU-CVE-2026-99093: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftracefilter=pudfreepmdpage panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:queuework+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetablefreekernel+0x20/0x120 [ 26.990283] queueworkon+0x97/0xf0 [ 27.134382] cpacollapselargepages+0x501/0x6f0 [ 27.566662] cpaflush+0x394/0x620 [ 27.998953] changepageattrsetclr+0x321/0x4a0 [ 29.151729] setmemoryrox+0xa2/0xf0 [ 29.584018] createtrampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from earlytraceinit(), which runs before workqueueinitearly(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetablefreekernel(), which queues work on systempercpuwq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetablefreekernel() before the workqueue that function relies on exists. Keep putting the table on the list, but don't schedule the work while the system is still booting. A coreinitcall schedules it once to free whatever was queued by then.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
During boot, keep deferred kernel page-table frees on the pending list without scheduling the work; schedule the queued work once from a core_initcall after the required workqueue has been initialized.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems booting a Linux kernel with the boot-time function tracer enabled and filtered to trace pud_free_pmd_page are affected. The reported failure occurs as the tracer starts during early boot.
What configuration is needed to trigger the panic?
The reported trigger is booting with ftrace=function and ftrace_filter=pud_free_pmd_page. The kernel then attempts deferred kernel page-table freeing during boot, leading to a null-pointer dereference and kernel panic.
How can administrators tell whether they have encountered this vulnerability?
Affected boots can show a general protection fault and KASAN null-pointer-dereference report in __queue_work, followed by "Kernel panic - not syncing: Attempted to kill the idle task!" The call trace includes pagetable_free_kernel, queue_work_on, and early tracing initialization paths.