Linux Kernel EUVD-2026-80654

Requires all of: (1) a non-SMP / uniprocessor kernel build (CONFIG_SMP=n) - the bug is UP-specific because spin_trylock() in NMI is unsafe there per can_spin_trylock(); (2) a BPF program (likely tracing) executing in NMI context that reaches the page-allocator free path free_pages_nolock(); and (3) local access with sufficient privilege to load such a BPF program (typically CAP_BPF/CAP_PERFMON or root). Limiting factors: modern production systems are overwhelmingly SMP, so most deployments are not affected; the alloc-side equivalent was already fixed (commit 620b46ed6ae17), this addresses only the missed free side; and the vendor did not reproduce the crash and rates the privilege-escalation outcome as merely 'probable.'

This is a classic over-scored Linux-kernel local bug. The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H) implies low-complexity local privilege escalation, but the description contradicts several of those metrics. AC:L is not credible: exploitation requires a non-SMP (UP/CONFIG_SMP=n) kernel build AND a BPF program executing in NMI context (tracing) that reaches free_pages_nolock() - a narrow, race-dependent, uncommon configuration, so AC:H is more honest. The author explicitly states the bugs were found during code review, were NOT reproduced, and that 'I suspect there is no real-world user that is affected by them,' and describes impact as it 'might crash the kernel and is probably exploitable' - hedged language, not a demonstrated LPE. That pushes the realistic impact toward denial-of-service (A:H) with at most speculative integrity impact (I:L) and no confidentiality loss (C:N). No EPSS score, no KEV listing, and no public PoC are provided, all consistent with a low-priority, review-discovered hardening fix rather than an actively exploited flaw. Net: treat as low real-world risk; patch on normal cadence unless you specifically ship UP kernels running BPF NMI tracing.

On a single-processor (non-SMP) Linux build, a local user with BPF privileges loads a tracing/BPF program that runs in NMI context and triggers the page-allocator free path (free_pages_nolock()), where an unsafe spin_trylock() in NMI causes a reentrancy/locking fault. This most likely crashes the kernel (DoS); the vendor speculates it is 'probably exploitable' for privilege escalation but did not reproduce it, and no public exploit code exists.