CVE-2026-90046

A flaw was found in the Linux kernel. Specifically, within the mm/page_alloc component, an issue exists with the spin_trylock() function when used in Non-Maskable Interrupt (NMI) contexts on Uniprocessor (UP) systems. A local attacker, by utilizing BPF (Berkeley Packet Filter) programs, could exploit this vulnerability to cause a kernel crash, leading to a denial of service, and potentially achieve privilege escalation.

free_pages_nolock can reach __free_frozen_pages with FPI_TRYLOCK from NMI context on non-SMP builds and the old guard did not use can_spin_trylock for this case. Using spin_trylock in this context can be unsafe and may corrupt page allocator state or crash the kernel when a BPF tracing program exercises the path from NMI. For the CVSS the PR:L is used because the realistic attacker is a local user or local process able to run relevant BPF tracing code or equivalent delegated tracing capability, while deployments that restrict BPF to full administrators may treat this as PR:H operationally. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.