CVE-2026-90303

A flaw was found in the Linux kernel. Under specific debug configurations, a local user could exploit a use-after-free vulnerability in the memory management subsystem. This issue arises when a user fault triggers a specific function without proper locking, while another process simultaneously frees memory pages. This could lead to system instability or a kernel crash, effectively causing a denial of service.

A race in the ARM user fault debug path can let show_pte traverse page table pages without holding the mmap lock while another thread in the same process removes mappings with munmap. This creates a use after free candidate in page table traversal and can cause a kernel panic, especially on ARM LPAE when PMD page table pages are freed during show_pte. For the CVSS the PR:L is used because a local user process can trigger user faults and concurrent mapping changes, but reliable triggering requires the affected debug configuration and a race window. The issue is not network reachable and requires local code execution on the target. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.