CVE-2026-97942 (GCVE-0-2026-97942)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 10:22
VLAI
Title
x86/alternatives: Exclude text poking against change_page_attr()
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against change_page_attr() From time to time, the following BUG can be observed in the x86 alternatives patching code [0]: > kernel BUG at arch/x86/kernel/alternative.c:2576! > Oops: invalid opcode: 0000 [#1] SMP NOPTI > CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 > RIP: 0010:__text_poke+0x2aa/0x450 > Call Trace: > <TASK> > smp_text_poke_batch_finish+0x2a7/0x320 > __static_call_transform+0xb7/0x220 > arch_static_call_transform+0x5b/0xb0 > __static_call_init+0xe9/0x270 > static_call_module_notify+0x11f/0x150 > notifier_call_chain+0x61/0xe0 > blocking_notifier_call_chain_robust+0x63/0xc0 > load_module+0x1c92/0x20c0 > init_module_from_file+0xd8/0x140 > idempotent_init_module+0x100/0x2f0 > __x64_sys_finit_module+0x71/0xe0 > do_syscall_64+0xe1/0x610 > entry_SYSCALL_64_after_hwframe+0x76/0x7e which matches the following BUG_ON() in alternative.c: /* * If something went wrong, crash and burn since recovery paths are not * implemented. */ BUG_ON(!pages[0] || (cross_page_boundary && !pages[1])); This can happen if vmalloc_to_page() fails, for any reason. Such can happen if text poking races with CPA, which can possibly result in the collapsing of page tables (or breaking of PMD hugepages). It is not a problem for most users of vmalloc_to_page() (they solely own the vmalloc'd range) but, when CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc range, and can call set_memory_*() in parallel on it. This can happen to race against __text_poke and cause havoc in vmalloc_to_page(). Fix it by excluding against CPA using the init_mm mmap read lock. [ dhansen: Fix up SoB ordering. The actual code flow here was: Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain now. I *believe* Mike simply picked up Lorenzo's update to Pedro's post from the Link ]
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d (git)
Affected: 64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 89c60435b90d32ab5e3a39da3ae73d463d07debe (git)
Affected: 64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 1587d3394e254639cc36516256031334095e6ef3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/alternative.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d",
              "status": "affected",
              "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
              "versionType": "git"
            },
            {
              "lessThan": "89c60435b90d32ab5e3a39da3ae73d463d07debe",
              "status": "affected",
              "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
              "versionType": "git"
            },
            {
              "lessThan": "1587d3394e254639cc36516256031334095e6ef3",
              "status": "affected",
              "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/alternative.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Exclude text poking against change_page_attr()\n\nFrom time to time, the following BUG can be observed\nin the x86 alternatives patching code [0]:\n\n  \u003e kernel BUG at arch/x86/kernel/alternative.c:2576!\n  \u003e Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  \u003e CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed  8c1795b03ec64f997e57a8ad38b1161e3b98da64\n  \u003e Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n  \u003e RIP: 0010:__text_poke+0x2aa/0x450\n  \u003e Call Trace:\n  \u003e  \u003cTASK\u003e\n  \u003e  smp_text_poke_batch_finish+0x2a7/0x320\n  \u003e  __static_call_transform+0xb7/0x220\n  \u003e  arch_static_call_transform+0x5b/0xb0\n  \u003e  __static_call_init+0xe9/0x270\n  \u003e  static_call_module_notify+0x11f/0x150\n  \u003e  notifier_call_chain+0x61/0xe0\n  \u003e  blocking_notifier_call_chain_robust+0x63/0xc0\n  \u003e  load_module+0x1c92/0x20c0\n  \u003e  init_module_from_file+0xd8/0x140\n  \u003e  idempotent_init_module+0x100/0x2f0\n  \u003e  __x64_sys_finit_module+0x71/0xe0\n  \u003e  do_syscall_64+0xe1/0x610\n  \u003e  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nwhich matches the following BUG_ON() in alternative.c:\n\n\t/*\n\t * If something went wrong, crash and burn since recovery paths are not\n\t * implemented.\n\t */\n\tBUG_ON(!pages[0] || (cross_page_boundary \u0026\u0026 !pages[1]));\n\nThis can happen if vmalloc_to_page() fails, for any reason. Such can happen\nif text poking races with CPA, which can possibly result in the collapsing\nof page tables (or breaking of PMD hugepages). It is not a problem for most\nusers of vmalloc_to_page() (they solely own the vmalloc\u0027d range) but, when\nCONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc\nrange, and can call set_memory_*() in parallel on it. This can happen to\nrace against __text_poke and cause havoc in vmalloc_to_page().\n\nFix it by excluding against CPA using the init_mm mmap read lock.\n\n[ dhansen: Fix up SoB ordering. The actual code flow here was:\n\t   Pedro=\u003eLorenzo=\u003eMike=\u003eMe which is reflected in the SoB chain\n\t   now. I *believe* Mike simply picked up Lorenzo\u0027s update to\n\t   Pedro\u0027s post from the Link ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:22:54.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d"
        },
        {
          "url": "https://git.kernel.org/stable/c/89c60435b90d32ab5e3a39da3ae73d463d07debe"
        },
        {
          "url": "https://git.kernel.org/stable/c/1587d3394e254639cc36516256031334095e6ef3"
        }
      ],
      "title": "x86/alternatives: Exclude text poking against change_page_attr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97942",
    "datePublished": "2026-09-25T10:22:54.188Z",
    "dateReserved": "2026-09-25T10:18:58.204Z",
    "dateUpdated": "2026-09-25T10:22:54.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97942",
      "date": "2026-09-28",
      "epss": "0.00198",
      "percentile": "0.08573"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kernel/alternative.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d",
                    "status": "affected",
                    "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89c60435b90d32ab5e3a39da3ae73d463d07debe",
                    "status": "affected",
                    "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1587d3394e254639cc36516256031334095e6ef3",
                    "status": "affected",
                    "version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kernel/alternative.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Exclude text poking against change_page_attr()\n\nFrom time to time, the following BUG can be observed\nin the x86 alternatives patching code [0]:\n\n  \u003e kernel BUG at arch/x86/kernel/alternative.c:2576!\n  \u003e Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  \u003e CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed  8c1795b03ec64f997e57a8ad38b1161e3b98da64\n  \u003e Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n  \u003e RIP: 0010:__text_poke+0x2aa/0x450\n  \u003e Call Trace:\n  \u003e  \u003cTASK\u003e\n  \u003e  smp_text_poke_batch_finish+0x2a7/0x320\n  \u003e  __static_call_transform+0xb7/0x220\n  \u003e  arch_static_call_transform+0x5b/0xb0\n  \u003e  __static_call_init+0xe9/0x270\n  \u003e  static_call_module_notify+0x11f/0x150\n  \u003e  notifier_call_chain+0x61/0xe0\n  \u003e  blocking_notifier_call_chain_robust+0x63/0xc0\n  \u003e  load_module+0x1c92/0x20c0\n  \u003e  init_module_from_file+0xd8/0x140\n  \u003e  idempotent_init_module+0x100/0x2f0\n  \u003e  __x64_sys_finit_module+0x71/0xe0\n  \u003e  do_syscall_64+0xe1/0x610\n  \u003e  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nwhich matches the following BUG_ON() in alternative.c:\n\n\t/*\n\t * If something went wrong, crash and burn since recovery paths are not\n\t * implemented.\n\t */\n\tBUG_ON(!pages[0] || (cross_page_boundary \u0026\u0026 !pages[1]));\n\nThis can happen if vmalloc_to_page() fails, for any reason. Such can happen\nif text poking races with CPA, which can possibly result in the collapsing\nof page tables (or breaking of PMD hugepages). It is not a problem for most\nusers of vmalloc_to_page() (they solely own the vmalloc\u0027d range) but, when\nCONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc\nrange, and can call set_memory_*() in parallel on it. This can happen to\nrace against __text_poke and cause havoc in vmalloc_to_page().\n\nFix it by excluding against CPA using the init_mm mmap read lock.\n\n[ dhansen: Fix up SoB ordering. The actual code flow here was:\n\t   Pedro=\u003eLorenzo=\u003eMike=\u003eMe which is reflected in the SoB chain\n\t   now. I *believe* Mike simply picked up Lorenzo\u0027s update to\n\t   Pedro\u0027s post from the Link ]"
          }
        ],
        "id": "CVE-2026-97942",
        "lastModified": "2026-09-25T11:17:21.633",
        "metrics": {},
        "published": "2026-09-25T11:17:21.633",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1587d3394e254639cc36516256031334095e6ef3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89c60435b90d32ab5e3a39da3ae73d463d07debe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.