CVE-2026-93227 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone() initializes struct pages early in boot to satisfy an allocation.
With a large CMA reservation in place, the ranges deferred_init_memmap() finds may not add up to the allocation it was asked for, and the function ends up initializing the memory map of the entire zone and still falls short.
That is fine in itself: the function accounts for it and leaves the caller to decide whether it now has enough memory.
However, the update of pgdat->first_deferred_pfn that tracks where uninitialized memory map starts could overflow.
If the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and some deferred struct pages were initialized, pgdat->first_deferred_pfn would point past the end of the node's memory.
deferred_init_memmap() later picks up from pgdat->first_deferred_pfn and hits a BUG_ON(), because it expects a pfn within its node.
For example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y and CONFIG_CMA=y using the following qemu command line
qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \ -append "nokaslr cma=4768M@0x100000000"
the kernel panics:
kernel BUG at mm/mm_init.c:2131! CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1 RIP: 0010:deferred_init_memmap+0x1b8/0x1c0 RAX: 0000000000236000 R13: 0000000000238000 Call Trace: kthread+0xdf/0x120 ret_from_fork+0x187/0x250
Make sure that the update of pgdta->first_deferred_pfn does not overflow when the entire zone's (and therefore node's) memory map is initialized.
[rppt: massaged the changelog]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel involves a critical integer overflow within the deferred struct page initialization subsystem, specifically affecting systems configured with CONFIG_DEFERRED_STRUCT_PAGE_INIT and substantial Contiguous Memory Allocator reservations. The core technical flaw resides in the deferred_grow_zone function, which is responsible for initializing memory structures early during the boot process to satisfy immediate allocation requests. When a large CMA reservation is present, the ranges identified by deferred_init_memmap may fail to accumulate enough pages to meet the requested allocation size. In such scenarios, the initialization logic proceeds to initialize the entire zone's memory map yet still falls short of the target amount. While this outcome is functionally acceptable as the caller can determine if sufficient memory has been acquired, the subsequent update to pgdat->first_deferred_pfn introduces a severe boundary violation. This variable tracks the starting physical frame number where uninitialized memory maps begin, and under specific conditions involving unaligned RAM ends relative to PAGES_PER_SECTION boundaries, it is updated to point past the end of the node's available memory.
This out-of-range pointer value triggers a catastrophic failure in subsequent boot stages because deferred_init_memmap relies on pgdat->first_deferred_pfn to determine where to resume initialization operations. Expecting a valid physical frame number within the current node, the function encounters an invalid address and immediately invokes a BUG_ON macro, resulting in a kernel panic. This issue is reproducible under specific configurations that combine deferred page init with large CMA reservations, such as those simulated via QEMU with significant memory constraints and alignment mismatches. The vulnerability represents a classic case of improper input validation or boundary checking during arithmetic operations on physical frame numbers, leading to out-of-bounds access logic within the kernel's memory management subsystem.
From a classification perspective, this flaw aligns closely with CWE-190 Integer Overflow or Wraparound, as the calculation for first_deferred_pfn exceeds the valid range of the node's memory map without proper clamping or validation checks. Furthermore, it relates to CWE-787 Out-of-bounds Write if one considers that subsequent operations might attempt to access structures based on this invalid pointer, although in this specific instance, the primary impact is a denial of service via kernel panic rather than arbitrary code execution. The vulnerability impacts system availability by preventing successful boot completion when specific memory configurations are active, effectively rendering the affected systems unusable until patched or reconfigured.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the update logic for pgdat->first_deferred_pfn to ensure it never exceeds the node's physical memory boundaries. Administrators running kernels with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled should verify their CMA reservation sizes and RAM alignment configurations, as these factors contribute to triggering the bug. Reducing the size of CMA reservations or ensuring that system memory layouts align better with page section boundaries can serve as temporary workarounds until a patched kernel version is deployed. Regular updates to the Linux kernel are essential to address such low-level memory management defects that compromise stability and reliability during critical initialization phases.