{"id":"CVE-2026-99093","kind":"vulnerability","aliases":["CVE-2026-99093"],"related":[],"title":"Linux kernel: boot-time tracer with page-table filter panics the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: don't schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n  ftrace=function ftrace_filter=pud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n  [   23.531178] Starting tracer 'function'\n  [   23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n  [   23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n  [   23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n  [   24.252248] RIP: 0010:__queue_work+0xab/0xf00\n  [   25.981629] Call Trace:\n  [   26.125727]  <TASK>\n  [   26.413912]  ? pagetable_free_kernel+0x20/0x120\n  [   26.990283]  queue_work_on+0x97/0xf0\n  [   27.134382]  __cpa_collapse_large_pages+0x501/0x6f0\n  [   27.566662]  cpa_flush+0x394/0x620\n  [   27.998953]  change_page_attr_set_clr+0x321/0x4a0\n  [   29.151729]  set_memory_rox+0xa2/0xf0\n  [   29.584018]  create_trampoline+0x431/0x6f0\n  ...\n  [   44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\n\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early().  Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away.  The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point.  That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\n\nKeep putting the table on the list, but don't schedule the work while\nthe system is still booting.  A core_initcall schedules it once to free\nwhatever was queued by then.","summary":"A Linux kernel boot-time function tracer with a filter on pud_free_pmd_page crashes the kernel during startup, causing a panic. The flaw is in deferred kernel page table freeing, which schedules work before the workqueue exists.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bare-metal","infrastructure","linux-kernel","virtual-machines"],"not_affected_if":["default-config"],"how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed stable release listed in the NVD entry.\n- Check the kernel command line for `ftrace=function` and `ftrace_filter=pud_free_pmd_page` (for example in `/proc/cmdline`).","fix":"- Update the Linux kernel to a release that includes the upstream fix for this CVE (the commit that stops scheduling deferred kernel page table freeing during boot).\n- Until patched, remove the boot-time ftrace parameters from the kernel command line.","status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:08+00:00","updated_at":"2026-10-26T16:04:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:04:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for this CVE (the commit that stops scheduling deferred kernel page table freeing during boot).\n- Until patched, remove the boot-time ftrace parameters from the kernel command line.","reach":"local","title":"Linux kernel: boot-time tracer with page-table filter panics the system","impact":"low","summary":"A Linux kernel boot-time function tracer with a filter on pud_free_pmd_page crashes the kernel during startup, causing a panic. The flaw is in deferred kernel page table freeing, which schedules work before the workqueue exists.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bare-metal","virtual-machines"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel panics during boot, causing denial of service","analyst_note":"Confirm the fixed kernel versions and stable backports from the NVD entry and kernel.org commit; the sources here give no version ranges.","how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed stable release listed in the NVD entry.\n- Check the kernel command line for `ftrace=function` and `ftrace_filter=pud_free_pmd_page` (for example in `/proc/cmdline`).","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only systems that boot with a boot-time function tracer and a filter on pud_free_pmd_page enabled, where the kernel panics as the tracer starts. The sources describe the panic on 7.3-rc4 and do not list affected stable release ranges. Systems without these boot parameters are unlikely to hit this path, though the sources do not say so explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4093,"output_tokens":640,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':181C,191C,197C,204C,209C,217C,223C,228C '-2026':16A,19A '-99093':17A,20A '0':157C,159C,161C '0000':139C '0010':178C '0x00000000000001c0':153C '0x00000000000001c0-0x00000000000001c7':152C '0x00000000000001c7':154C '0xdffffc0000000038':138C '1':140C '195':173C '23.531178':123C '23.675800':127C '23.819917':144C '23.964025':155C '24.252248':176C '25.981629':183C '26.125727':186C '26.413912':187C '26.990283':193C '27.134382':199C '27.566662':206C '27.998953':211C '29.151729':219C '29.584018':225C '44.343347':230C '7.3':115C '7.3.0':166C '9e4':286C 'a3ec3411b':287C 'address':137C 'alloc':289C 'attempt':235C 'attr':214C 'away':274C 'bare':22B 'bare-met':21B 'boot':4A,35B,91C,92C,96C,243C,358C 'boot-tim':3A,34B,95C,242C 'call':184C 'canon':136C 'caus':52B 'chang':212C 'clr':216C 'collaps':201C,270C,299C 'comm':162C 'commit':285C,319C 'core':360C 'correct':321C 'cpa':200C,207C,269C,327C 'cpu':156C 'crash':47B 'creat':226C 'cve':15A,18A 'defer':59B,85C 'deref':149C 'earli':249C,257C 'exampl':104C 'exist':70B,339C 'fault':131C 'fe2ec83746e5':169C 'filter':11A,41B,102C,108C 'fix':171C 'flaw':56B 'flush':208C 'follow':76C 'free':44B,63B,89C,110C,189C,300C,304C,330C,366C 'ftrace':105C,107C 'function':37B,98C,106C,126C,336C 'general':129C 'idl':239C 'infrastructur':24B 'init':251C,256C 'initcal':361C 'kasan':142C,145C 'keep':340C 'kernel':2A,27B,33B,49B,60B,74C,86C,190C,231C,281C,294C,305C,331C 'kill':237C 'larg':202C,266C 'let':326C 'linux':1A,26B,32B,73C 'linux-kernel':25B 'list':346C 'machin':30B 'make':258C 'memori':221C 'metal':23B 'mm':81C 'non':135C 'non-canon':134C 'nopti':143C 'null':147C,314C 'null-ptr-deref':146C 'oop':128C 'page':9A,46B,61B,87C,112C,203C,213C,267C,282C,291C,295C 'page-t':8A 'paget':188C,303C,329C 'panic':12A,54B,113C,232C 'percpu':311C 'pid':160C 'pmd':45B,111C 'point':317C 'preempt':174C 'probabl':132C 'protect':130C 'ptr':148C 'pud':43B,109C 'put':341C 'queu':369C 'queue':179C,194C,307C 'rang':151C 'rc4':116C,168C 'rc4-fe2ec83746e5-with-fixes-v2':167C 'reach':328C 'read':262C 'read-on':261C 'reli':337C 'resolv':80C 'right':273C 'rip':177C 'rox':222C 'run':253C 'schedul':65B,84C,350C,362C 'set':215C,220C 'sinc':284C 'smp':141C 'soon':118C 'split':264C,276C,290C 'start':122C,124C,247C 'startup':51B 'still':313C,357C 'swapper':163C 'sync':234C 'system':14A,310C,355C 'tabl':10A,62B,88C,277C,283C,292C,296C,343C 'taint':165C 'task':240C 'time':5A,36B,97C,244C 'trace':185C,250C 'tracer':6A,38B,99C,121C,125C,245C 'trampolin':227C,260C 'uid':158C 'undef':175C 'v2':172C 'virtual':29B 'virtual-machin':28B 'vulner':77C 'whatev':367C 'work':66B,180C,195C,308C,352C 'workqueu':69B,255C,334C 'wq':312C 'x20/0x120':192C 'x321/0x4a0':218C 'x394/0x620':210C 'x431/0x6f0':229C 'x501/0x6f0':205C 'x86/mm/pat':288C 'x97/0xf0':198C 'xa2/0xf0':224C 'xab/0xf00':182C","nicknames":[],"mitigations":[],"who_affected":"Only systems that boot with a boot-time function tracer and a filter on pud_free_pmd_page enabled, where the kernel panics as the tracer starts. The sources describe the panic on 7.3-rc4 and do not list affected stable release ranges. Systems without these boot parameters are unlikely to hit this path, though the sources do not say so explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99093","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}