CVE-2026-90383

What it actually does

Race condition in GRU TLB miss handler performing unlocked page-table walks on user mappings from interrupt context, using kernel accessors on user tables and limited to PMD large mappings.

Why it matters to the business

Local attackers on affected Linux systems can achieve kernel-level code execution, resulting in full system compromise, data theft, or denial of service; low exploitation likelihood reduces immediate risk but still requires prompt patching on GRU-enabled hardware.

How an attack unfolds

An attacker with local access triggers GRU TLB misses that race with concurrent page-table modifications; the unlocked walker dereferences stale or freed entries, allowing memory corruption that is escalated to arbitrary kernel code execution.

How to fix it

Update to a Linux kernel version that removes the direct GRU page-table walker and routes faults through user polling mode; rebuild and reboot all systems using the sgi-gru driver.

How to confirm the fix worked

Confirm the vulnerable walker code and mmap-lock statistic have been removed from the sgi-gru interrupt handler; run regression tests that exercise GRU TLB faults under concurrent page-table changes.

Typical attack path

1. Obtain local user access on a system with the sgi-gru driver loaded
2. Craft workload that induces frequent TLB misses while modifying page tables from another thread
3. Trigger the interrupt-context walker to hit a window of inconsistent page-table state
4. Leverage resulting memory corruption to overwrite kernel structures or redirect execution
5. Escalate to root and install persistent implants

How to detect it

Review kernel logs and audit trails for unusual GRU TLB fault patterns or mmap-lock statistic anomalies prior to the fix; correlate with local privilege-escalation attempts on GRU-equipped hosts.

What your security team should do

• Prioritize kernel updates on any systems exposing the sgi-gru driver within the next patching cycle
• Audit kernel configurations to disable the GRU driver where hardware is absent
• Monitor EPSS and exploit maturity for any future increase in public tooling