CVE-2026-90201

A flaw was found in the Linux kernel's page_pool networking component. A race condition can occur when the page_pool_destroy() function runs concurrently with page return operations. This race condition can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to access memory after it has been freed. This could potentially allow an attacker to cause a denial of service or execute arbitrary code.

A race in net page_pool DMA cleanup can cause a use-after-free when page_pool_destroy() runs page_pool_scrub() while another CPU returns a page through page_pool_put_netmem(). The scrub path iterates pool dma_mapped without holding a page reference, while the return path can drop the last page reference after losing xa_cmpxchg. This allows the scrub path to read or update netmem fields after the page has been freed. For the CVSS the PR:L is used in the paranoid score because reliable triggering may be possible for a local actor with delegated CAP_NET_ADMIN or similar control over NIC channel or ring reconfiguration. The issue is not directly network reachable by packets alone, but traffic such as iperf style load can help exercise the race while local reconfiguration is performed. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to UAF based memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.