CVE-2026-90303 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte().
If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running.
Acquire mmap_write_lock() around show_pte() for user faults to fix the contention.
For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications.
Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified as ARM 9485/1 represents a critical race condition within the memory management subsystem that leads to use-after-free errors and potential system instability during user-space fault handling. This issue specifically manifests when the kernel is compiled with CONFIG_DEBUG_USER enabled and the boot parameter user_debug=31 is active, which enables verbose debugging output for user faults. Under these conditions, the function show_pte() is invoked to dump page table information for diagnostic purposes. However, this invocation occurs without acquiring the necessary mmap write lock, leaving a window of vulnerability where concurrent memory operations can interfere with the ongoing traversal of page tables.
The core technical flaw lies in the lack of synchronization between the fault handling path and other threads within the same process that may be modifying its virtual address space. Specifically, if another thread concurrently executes munmap() to unmap regions of memory while show_pte() is traversing those same page table entries, there is a high probability that the underlying page table pages will be freed before show_pte() completes its read operations. This scenario constitutes a classic use-after-free vulnerability where the kernel attempts to access memory structures that have already been deallocated and potentially reallocated for other purposes. In systems configured with CONFIG_ARM_LPAE, which enables Large Physical Address Extension support, this race condition can result in accessing freed PMD (Page Middle Directory) entries, leading directly to a kernel panic due to invalid memory references or corrupted data interpretation.
From an operational impact perspective, the severity of this vulnerability depends heavily on the system configuration and workload characteristics. For systems with CONFIG_ARM_LPAE enabled, the immediate consequence is a denial of service through a kernel crash, effectively halting all operations on the affected device. Even in configurations where a panic does not immediately occur, the use-after-free condition poses significant security risks by allowing potential information disclosure or code execution if an attacker can carefully time their munmap calls to exploit the race window. The vulnerability is further exacerbated by the fact that show_pte() was previously called for kernel-space addresses during user faults, which is unnecessary and expands the attack surface beyond what is required for standard debugging tasks.
To mitigate this risk, the resolution involves acquiring the mmap_write_lock around the invocation of show_pte() specifically for user faults. This lock ensures exclusive access to the memory map structure, preventing concurrent modifications such as munmap from freeing page table pages while they are being read by the diagnostic routine. Additionally, the fix restricts the call to show_pte() so that it only executes when the faulting address is within the user-space range defined by TASK_SIZE. This change eliminates the unnecessary and potentially hazardous dumping of kernel-space page tables during user faults, thereby reducing both performance overhead and security exposure. The mitigation strategy carefully preserves existing behavior for kernel faults, as acquiring locks in an oops state could introduce deadlocks that would further destabilize a system already experiencing critical errors.
This vulnerability aligns with CWE-416, Use After Free, which describes the danger of referencing memory after it has been freed, often leading to unpredictable program behavior or security breaches. Furthermore, the exploitation vector relates to ATT&CK technique T1059, Command and Scripting Interpreter, as an attacker might leverage such kernel instability to facilitate privilege escalation or system compromise in embedded ARM-based environments where debug features are inadvertently left enabled in production builds. The fix underscores the importance of proper synchronization primitives in concurrent memory management operations and highlights the risks associated with enabling verbose debugging flags in deployed systems without adequate safeguards against race conditions.