p PatchFirst

CVE-2026-98939

CVE-2026-98939 · x86/mm: Drop unnecessary PMD page copy when freeing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page protection munging code. The huge vmap code holds the same lock over a GFP_KERNEL allocation, which is a no-no now that reclaim can take it. That allocation is in a page table *free* path and ends up being for dubious purposes[1]. Basically, it tries to avoid hardware setting Accessed=1 in page table entries that are unreachable by the hardware, a non-issue. Remove the PMD copy. Detach the original PMD page at the PUD, flush the mid-level caches, and free the PTE tables straight from the detached PMD page. With no allocation left, the locking issue is gone. Lockdep splat/analysis: WARNING: possible circular locking dependency detected 7.3.0-rc3-f6e7b42bf05b+ #183 Tainted: G U ------------------------------------------------------ kswapd0/269 is trying to acquire lock: ((init_mm).mmap_lock){++++}-{4:4}, at: change_page_attr_set_clr+0x29a/0x4a0 but task is already holding lock: (pool_shrink_rwsem){.+.+}-{4:4}, at: ttm_pool_shrink+0xb2/0x330 [ttm] Chain exists of: (init_mm).mmap_lock --> fs_reclaim --> pool_shrink_rwsem The cycle is built from three edges: 1) pool_shrink_rwsem -> (init_mm).mmap_lock The TTM shrinker restores the caching attribute of every page it frees, while holding pool_shrink_rwsem: ttm_pool_shrink() -> ttm_pool_dispose_list() -> ttm_pool_free_page() -> set_pages_wb() -> change_page_attr_set_clr() [ init_mm mmap read lock ] 2) fs_reclaim -> pool_shrink_rwsem The same shrinker, called from reclaim. 3) (init_mm).mmap_lock -> fs_reclaim ioremap() installing a huge PUD mapping over an existing PMD table: ioremap_page_range() -> vmap_range_noflush() -> vmap_try_huge_pud() [ init_mm mmap read lock ] -> pud_free_pmd_page() -> __get_free_page(GFP_KERNEL) [ enters reclaim ] [ dhansen: Lots of changelog munging/trimming and merged comments from my version of the fix. ]

Fix available

Published
Updated

Stack: system

Affected products and versions

  • linux

    Versions
    • ≥ e21a9ea81426a85fdb0cdcfcc99d5d9c16b402ab, < d3c2d2692bdf4af94bb27bc7a3aa0a348a567606: Affected (git)
    • ≥ cc73b2043d106b467accd38e9b1fc09e0607c056, < f38c57a28ebbd057471573e39555d5aa11ab03cf: Affected (git)
    • ≥ d5d8b8662e6e5a565b47a0388640e88402f23274, < e3ee38c1bc0b11a8d3e63dce7050759b61864286: Affected (git)

    Update to f38c57a28ebbd057471573e39555d5aa11ab03cf

  • linux

    Versions
    • ≥ 6.18.53, < 6.18.56: Affected (semver)
    • ≥ 7.2.7, < 7.2.10: Affected (semver)

    Update to 6.18.56; Update to 7.2.10

  • linux Debian:14

    Versions
    • 6.12.100-1
    • 6.12.101-1
    • 6.12.105-1
    • 6.12.107-1
    • 6.12.111-1
    • 6.12.113-1
    • 6.12.38-1
    • 6.12.41-1
    • 6.12.43-1
    • 6.12.43-1~bpo12+1
    • 6.12.48-1
    • 6.12.57-1
    • 6.12.57-1~bpo12+1
    • 6.12.63-1
    • 6.12.63-1~bpo12+1
    • 6.12.69-1
    • 6.12.69-1~bpo12+1
    • 6.12.73-1
    • 6.12.73-1~bpo12+1
    • 6.12.74-1
    • 6.12.74-2
    • 6.12.74-2~bpo12+1
    • 6.12.85-1
    • 6.12.85-1~bpo12+1
    • 6.12.86-1
    • 6.12.86-1~bpo12+1
    • 6.12.88-1
    • 6.12.88-1~bpo12+1
    • 6.12.90-1
    • 6.12.90-1~bpo12+1
    • 6.12.90-2
    • 6.12.90-2~bpo12+1
    • 6.12.94-1
    • 6.12.94-1~bpo12+1
    • 6.12.95-1
    • 6.12.95-1~bpo12+1
    • 6.12.96-1
    • 6.13.10-1~exp1
    • 6.13.11-1~exp1
    • 6.13.2-1~exp1
    • 6.13.3-1~exp1
    • 6.13.4-1~exp1
    • 6.13.5-1~exp1
    • 6.13.6-1~exp1
    • 6.13.7-1~exp1
    • 6.13.8-1~exp1
    • 6.13.9-1~exp1
    • 6.13~rc6-1~exp1
    • 6.13~rc7-1~exp1
    • 6.14.3-1~exp1
    • 6.14.5-1~exp1
    • 6.14.6-1~exp1
    • 6.15-1~exp1
    • 6.15.1-1~exp1
    • 6.15.2-1~exp1
    • 6.15.3-1~exp1
    • 6.15.4-1~exp1
    • 6.15.5-1~exp1
    • 6.15.6-1~exp1
    • 6.15~rc7-1~exp1
    • 6.16-1~exp1
    • 6.16.1-1~exp1
    • 6.16.10-1
    • 6.16.11-1
    • 6.16.12-1
    • 6.16.12-1~bpo13+1
    • 6.16.12-2
    • 6.16.3-1
    • 6.16.3-1~bpo13+1
    • 6.16.5-1
    • 6.16.6-1
    • 6.16.7-1
    • 6.16.8-1
    • 6.16.9-1
    • 6.16~rc7-1~exp1
    • 6.17.10-1
    • 6.17.11-1
    • 6.17.12-1
    • 6.17.13-1
    • 6.17.13-1~bpo13+1
    • 6.17.2-1~exp1
    • 6.17.5-1~exp1
    • 6.17.6-1
    • 6.17.7-1
    • 6.17.7-2
    • 6.17.8-1
    • 6.17.8-1~bpo13+1
    • 6.17.9-1
    • 6.18.1-1~exp1
    • 6.18.10-1
    • 6.18.12-1
    • 6.18.12-1~bpo13+1
    • 6.18.13-1
    • 6.18.14-1
    • 6.18.15-1
    • 6.18.15-1~bpo13+1
    • 6.18.2-1~exp1
    • 6.18.3-1
    • 6.18.5-1
    • 6.18.5-1~bpo13+1
    • 6.18.8-1
    • 6.18.9-1
    • 6.18.9-1~bpo13+1
    • 6.18~rc4-1~exp1
    • 6.18~rc4-1~exp2
    • 6.18~rc5-1~exp1
    • 6.18~rc6-1~exp1
    • 6.18~rc7-1~exp1
    • 6.19-1~exp1
    • 6.19.10-1
    • 6.19.10-1~bpo13+1
    • 6.19.11-1
    • 6.19.11-1~bpo13+1
    • 6.19.12-1
    • 6.19.13-1
    • 6.19.13-1~bpo13+1
    • 6.19.14-1
    • 6.19.14-1~bpo13+1
    • 6.19.2-1~exp1
    • 6.19.3-1~exp1
    • 6.19.4-1~exp1
    • 6.19.5-1~exp1
    • 6.19.6-1
    • 6.19.6-2
    • 6.19.6-2~bpo13+1
    • 6.19.8-1
    • 6.19.8-1~bpo13+1
    • 6.19~rc4-1~exp1
    • 6.19~rc5-1~exp1
    • 6.19~rc6-1~exp1
    • 6.19~rc7-1~exp1
    • 6.19~rc8-1~exp1
    • 7.0-1~exp1
    • 7.0.1-1~exp1
    • 7.0.10-1
    • 7.0.10-1~bpo13+1
    • 7.0.12-1
    • 7.0.12-2
    • 7.0.12-2~bpo13+1
    • 7.0.13-1
    • 7.0.13-1~bpo13+1
    • 7.0.14-1
    • 7.0.3-1
    • 7.0.4-1
    • 7.0.4-1~bpo13+1
    • 7.0.7-1
    • 7.0.7-1~bpo13+1
    • 7.0.9-1
    • 7.0.9-1~bpo13+1
    • 7.1.1-1~exp1
    • 7.1.10-1
    • 7.1.12-1
    • 7.1.13-1
    • 7.1.13-1~bpo13+1
    • 7.1.2-1~exp1
    • 7.1.3-1
    • 7.1.3-1+sunvdc
    • 7.1.3-1~bpo13+1
    • 7.1.4-1
    • 7.1.5-1
    • 7.1.6-1
    • 7.1.7-1
    • 7.1.7-1~bpo13+1
    • 7.1.8-1
    • 7.1.8-1~bpo13+1
    • 7.1.8-2
    • 7.1.9-1
    • 7.1.9-1+sparc64
    • 7.1~rc2-1~exp1
    • 7.1~rc3-1~exp1
    • 7.1~rc4-1~exp1
    • 7.1~rc4-1~exp2
    • 7.1~rc5-1~exp1
    • 7.1~rc7-1~exp1
    • 7.2.2-1~exp1
    • 7.2.3-1~exp1
    • 7.2.6-1
    • 7.2.6-1~bpo13+1
    • 7.2.7-1
    • 7.2.8-1
    • 7.2.9-1
    • 7.2.9-1~bpo13+1
    • 7.2~rc3-1~exp1
    • 7.2~rc5-1~exp1
    • 7.2~rc7-1~exp1
    Affected ranges
    • ECOSYSTEM: < 7.2.10-1

    Update to 7.2.10-1

Original sources

Check your server →