Linux Kernel EUVD-2026-86833

Requires an affected x86 Linux kernel (6.18.7 through 6.18.53, or 6.19) that includes the deferred-kernel-page-table-freeing behavior from commit 5ba2f0a15564 and the SVA IOTLB-invalidation behavior from e37d5a2d60a3. The stale-IOTLB consequence only becomes harmful when an IOMMU with SVA (shared virtual addressing over kernel address space) is active on the platform, and the split path must be exercised by privileged memory-attribute changes (CPA / set_memory_* operations). Limiting factors: local access only, high privilege needed to drive CPA splits, IOMMU/SVA must be configured, a timing/reuse window between free and stale-entry use is required, and only a narrow band of very recent kernels is vulnerable.

This is a Linux kernel x86/mm/pat memory-management correctness bug: when the CPA (change-page-attributes) code splits a large page via __split_large_page(), the split PTE is allocated directly rather than through pte_alloc_one_kernel(), so the page table is never marked as a kernel page table. Because of commit 5ba2f0a15564 (deferred freeing) and e37d5a2d60a3 (IOTLB invalidation for kernel page tables), these unmarked split tables are freed WITHOUT IOTLB invalidation, leaving stale IOTLB entries for kernel address space. The input CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 8.2) reads as full-impact local privileged, but the description describes an internal coherence defect triggered by ordinary privileged memory operations, not an attacker-driven primitive - realistic impact is stale device/IOMMU mappings that most plausibly cause corruption or crashes (DoS-dominant), with confidentiality/integrity secondary and speculative. No EPSS score, no CISA KEV listing, and no public POC are provided, and there is no assigned CWE. SSVC-style read: exploitation none-observed, not automatable, technical impact partial-at-best from an attacker standpoint. Net: high-CVSS on paper but low real-world offensive priority - it is fundamentally a reliability/hardening fix gated on IOMMU/SVA usage and very recent kernels. The 'Information Disclosure' tag conflicts with the actual defect class (stale IOTLB → corruption/DoS), which should be verified.

On an x86 host running an affected kernel (6.18.7-6.18.53 or 6.19) with an IOMMU and SVA in use, a privileged operation that changes memory attributes causes CPA to split a large page; the split page table is later freed without IOTLB invalidation. A device sharing kernel address space then uses a stale IOTLB entry pointing at a page table that has been freed and repurposed, leading to memory corruption or a crash. No public exploit is identified and there is no evidence of active exploitation.