EUVD-2026-80654
GHSA-h63h-wcx8-jm4r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local BPF-loading privilege (PR:L); UP-only plus NMI reentrancy race makes it AC:H; crash-dominant so A:H, no info leak (C:N), only speculative integrity (I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't spin_trylock() in NMI on UP
Patch series "mm/page_alloc: fixes for free_pages_nolock() on RT/UP".
Pre-existing bugs found by Sashiko during review of this other series: https://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/
I have not reproduced these bugs, and I suspect there is no real-world user that is affected by them.
This patch (of 2):
As noted in can_spin_trylock(), using this is unsafe in this context. commit 620b46ed6ae17 ("mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP") fixed this on the alloc side but missed the free side.
Impact: If BPF programs using these features in NMI (probably tracing) are present on non-SMP builds this might crash the kernel and is probably exploitable by local attackers for privilege escalation.
AnalysisAI
Kernel crashes or potential privilege escalation can occur in uniprocessor (non-SMP) Linux kernels when a BPF program executing in NMI context reaches the free_pages_nolock() path, due to an unsafe spin_trylock() call. This vulnerability affects only systems built with CONFIG_SMP=n, and while the alloc-side equivalent was already fixed, the free side remained vulnerable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires all of: (1) a non-SMP / uniprocessor kernel build (CONFIG_SMP=n) - the bug is UP-specific because spin_trylock() in NMI is unsafe there per can_spin_trylock(); (2) a BPF program (likely tracing) executing in NMI context that reaches the page-allocator free path free_pages_nolock(); and (3) local access with sufficient privilege to load such a BPF program (typically CAP_BPF/CAP_PERFMON or root). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic over-scored Linux-kernel local bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches by upgrading to Linux 7.2.5, 7.3-rc1, or 6.18.51, or by applying the specific stable commits (06c76d3c389ff504052f64b1acee44651bd847fa, 68a069b407303e71db371df85036101e8ff59280, 3105ae628fb785d48b49256468be4f21a7b3cfc0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine which systems in the estate run single-processor (CONFIG_SMP=n) Linux kernels, focusing on embedded appliances, OT/industrial controllers, and legacy single-core hosts, since conventional multi-core enterprise Linux is not exposed; confirm the exposure list with asset owners and open change control. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today