SB20261023236 - Deadlock in Linux kernel x86 mm

Description

This security bulletin contains information about 1 vulnerability.

1) Deadlock (CVE-ID: CVE-2026-98939)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel deadlock.

The vulnerability exists due to a circular locking dependency in pud_free_pmd_page() in the x86 memory-management subsystem when a GFP_KERNEL allocation can enter memory reclaim while the init_mm mmap lock is held during huge PUD mapping setup. A local user can exercise the affected mapping and memory-reclaim paths to potentially cause a deadlock involving the mmap lock, memory reclaim, and the TTM page-pool lock, resulting in a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/d3c2d2692bdf4af94bb27bc7a3aa0a348a567606
• https://git.kernel.org/stable/c/e3ee38c1bc0b11a8d3e63dce7050759b61864286
• https://git.kernel.org/stable/c/f38c57a28ebbd057471573e39555d5aa11ab03cf