SB20260928267 - Use-after-free in Linux kernel x86 CPA cpa_collapse_large_pages function

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-97943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in kernel page tables.

The vulnerability exists due to a use-after-free in cpa_collapse_large_pages when collapsing kernel page table entries. A local user can race a CPA collapse operation with a page-table walk to trigger a use-after-free in kernel page tables.

The affected collapse path is reached only when CPA_COLLAPSE is specified through set_memory_rox().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/35820cf8dd521f5a651e221483015b0586794516
• https://git.kernel.org/stable/c/93b98882198b15bd482da1fe8e84b05c7c3b3d83
• https://git.kernel.org/stable/c/a1c7570cedd03372812a5b693732880867babbca