Cloudanix VulnDB

CVE-2026-90303

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A rare race condition in the Linux kernel on certain ARM devices can let one program accidentally read memory that another program has already released, potentially crashing the whole system when specific debug settings are turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free during page table traversal in show_pte() for user faults when CONFIG_DEBUG_USER is enabled and user_debug=31, allowing concurrent munmap() to free tables while they are being walked; with CONFIG_ARM_LPAE this can panic the kernel.

Why it matters to the business

Systems running the affected kernel on ARM with debug options enabled may experience unexpected kernel crashes or panics during normal operation, causing service outages and requiring reboots.

How an attack unfolds

An attacker with the ability to trigger user-space faults (via crafted input or memory operations) and concurrently perform munmap() operations in another thread can induce the race condition; the kernel must be compiled with CONFIG_DEBUG_USER and the cmdline must enable the debug level.

How to fix it

Apply the upstream patch that acquires the mmap write lock around show_pte() for user faults and restricts the call to addresses below TASK_SIZE; rebuild and deploy the fixed kernel; disable CONFIG_DEBUG_USER or the user_debug cmdline option if the functionality is not required.

How to confirm the fix worked

Confirm the kernel source contains the mmap_write_lock acquisition and the TASK_SIZE address check around show_pte(); verify the running kernel was built from the patched tree and that the debug options are either removed or no longer trigger the vulnerable path.

Typical attack path

  1. Enable CONFIG_DEBUG_USER and set user_debug=31 on the target ARM system
  2. Trigger a user fault that invokes show_pte()
  3. Concurrently execute munmap() from another thread in the same process
  4. Cause page-table pages to be freed while show_pte() walks them
  5. Trigger use-after-free resulting in kernel panic (especially under LPAE)

How to detect it

Search kernel logs for oops or panic messages referencing show_pte or page table walks; correlate timestamps of user faults with concurrent munmap activity in process memory maps; review dmesg and syslog for CONFIG_DEBUG_USER-triggered output.

What your security team should do

  • Prioritize patching ARM-based Linux systems that have CONFIG_DEBUG_USER enabled
  • Review kernel build configurations to disable unnecessary debug options in production
  • Monitor for kernel oops or panic events on affected systems until patches are deployed
  • Test the patched kernel in staging environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte(). If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running. Acquire mmap_write_lock() around show_pte() for user faults to fix the contention. For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications. Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock.

Affected packages

Ecosystem Package Introduced Fixed