---
id: "CVE-2026-99093"
kind: "vulnerability"
aliases: ["CVE-2026-99093"]
title: "Linux kernel: boot-time tracer with page-table filter panics the system"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bare-metal", "infrastructure", "linux-kernel", "virtual-machines"]
not_affected_if: ["default-config"]
published_at: "2026-10-26T15:16:48+00:00"
first_seen_at: "2026-10-26T16:02:26+00:00"
updated_at: "2026-10-26T16:04:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99093", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# Linux kernel: boot-time tracer with page-table filter panics the system

A Linux kernel boot-time function tracer with a filter on pud_free_pmd_page crashes the kernel during startup, causing a panic. The flaw is in deferred kernel page table freeing, which schedules work before the workqueue exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kernel version with `uname -r` and compare it against the fixed stable release listed in the NVD entry.
- Check the kernel command line for `ftrace=function` and `ftrace_filter=pud_free_pmd_page` (for example in `/proc/cmdline`).

## Fix

- Update the Linux kernel to a release that includes the upstream fix for this CVE (the commit that stops scheduling deferred kernel page table freeing during boot).
- Until patched, remove the boot-time ftrace parameters from the kernel command line.

## Timeline

- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99093

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

mm: don't schedule deferred kernel page table freeing while booting

Booting with a boot-time function tracer and a filter, for example

  ftrace=function ftrace_filter=pud_free_pmd_page

panics on 7.3-rc4 as soon as the tracer starts:

  [   23.531178] Starting tracer 'function'
  [   23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI
  [   23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
  [   23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)
  [   24.252248] RIP: 0010:__queue_work+0xab/0xf00
  [   25.981629] Call Trace:
  [   26.125727]  <TASK>
  [   26.413912]  ? pagetable_free_kernel+0x20/0x120
  [   26.990283]  queue_work_on+0x97/0xf0
  [   27.134382]  __cpa_collapse_large_pages+0x501/0x6f0
  [   27.566662]  cpa_flush+0x394/0x620
  [   27.998953]  change_page_attr_set_clr+0x321/0x4a0
  [   29.151729]  set_memory_rox+0xa2/0xf0
  [   29.584018]  create_trampoline+0x431/0x6f0
  ...
  [   44.343347] Kernel panic - not syncing: Attempted to kill the idle task!

The boot-time tracer is started from early_trace_init(), which runs
before workqueue_init_early().  Making its trampoline read-only splits a
large page, and CPA collapses it again right away.  The split table has
been a kernel page table since commit 9e4a3ec3411b
("x86/mm/pat: Allocate split page tables as kernel page tables"), so the
collapse frees it through pagetable_free_kernel(), which queues work on
system_percpu_wq - still NULL at that point.  That commit is correct in
itself; it only lets CPA reach pagetable_free_kernel() before the
workqueue that function relies on exists.

Keep putting the table on the list, but don't schedule the work while
the system is still booting.  A core_initcall schedules it once to free
whatever was queued by then.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_