{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  x86/mm/pat: Take cpa_lock around large-page collapse  Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:    BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0   Write of size 8 at addr ffff888181139718 by task modprobe   ...   The buggy address belongs to the physical page:    pfn:0x181139 ... page_type: f2(table)  cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD:    CPU A (module load)              CPU B (module finalize)   -------------------              -----------------------   execmem_make_temp_rw    set_memory_nx     __change_page_attr      split 2M -\u003e 4K table P      kpte = \u0026P[i]  (lockless)                                    execmem_restore_rox                                     set_memory_rox (CPA_COLLAPSE)                                      cpa_collapse_large_pages                                       rebuild leaf PMD                                       flush_tlb_all                                       pagetable_free(P)      set_pte_atomic(kpte, ...)        -\u003e writes into freed P  P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text.  The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P.  Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit (\"x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()\"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free.",
  "id": "DEBIAN-CVE-2026-93066",
  "modified": "2026-09-18T04:47:40.147240864Z",
  "published": "2026-09-17T17:18:00.380Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-93066"
    }
  ],
  "upstream": [
    "CVE-2026-93066"
  ]
}