CVE-2026-97943: x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

CVE-2026-97943: x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

x86 implements page attribute modification using its Change Page
Attributes (CPA) mechanism.

This tracks properties of ranges such as cache mode through x86 page
attributes, and as part of that logic manipulates kernel page tables.

Since commit:

  41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation")

ranges of kernel page table entries can be collapsed into
huge page table entries as part of this logic.

As part of this collapse, it frees the page tables which the collapsed
entries previously pointed to, and it does so without any relevant locks
being held to preclude concurrent kernel page table walkers.

The only way this code can be reached is if CPA_COLLAPSE is specified, and
this is only set in set_memory_rox() via:

set_memory_rox()
-> change_page_attr_set_clr()
-> cpa_flush()
-> cpa_collapse_large_pages()

Notable users of this are execmem and BPF when manipulating executable
mappings.

However, this is problematic for ptdump as it walks ranges it does not own
and thus runs the risk of a use-after-free on page tables freed underneath
it.

In addition, concurrent CPA collapse operations are possible which can also
cause races.

Resolve the issue by acquiring the mmap write lock on init_mm across the
whole operation.

It is safe to acquire a sleeping lock as all the callers invoke
set_memory_rox() from process context and in any case,
change_page_attr_set_clr() calls vm_unmap_alias() which ultimately takes a
mutex, disallowing atomic context here.

The Linux kernel CVE team has assigned CVE-2026-97943 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 41d88484c71cd4f659348da41b7b5b3dbd3be1f6 and fixed in 6.18.53 with commit 35820cf8dd521f5a651e221483015b0586794516
	Issue introduced in 6.15 with commit 41d88484c71cd4f659348da41b7b5b3dbd3be1f6 and fixed in 7.2.7 with commit 93b98882198b15bd482da1fe8e84b05c7c3b3d83
	Issue introduced in 6.15 with commit 41d88484c71cd4f659348da41b7b5b3dbd3be1f6 and fixed in 7.3-rc4 with commit a1c7570cedd03372812a5b693732880867babbca

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97943
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/mm/pat/set_memory.c
	include/linux/mmap_lock.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/35820cf8dd521f5a651e221483015b0586794516
	https://git.kernel.org/stable/c/93b98882198b15bd482da1fe8e84b05c7c3b3d83
	https://git.kernel.org/stable/c/a1c7570cedd03372812a5b693732880867babbca