CVE-2026-90383

A flaw was found in the Linux kernel's SGI GRU (Graphics Resource Unit) TLB (Translation Lookaside Buffer) miss handler. This handler incorrectly walks a process's page tables without holding necessary locks or references, and uses kernel page-table accessors on user page tables. This could allow a local attacker to gain unauthorized access to memory or potentially escalate privileges.

The SGI GRU TLB miss handler could walk user process page tables in interrupt context without holding page-table locks and without taking a reference on the mapped page. A local user with access to GRU functionality may be able to race address translation against mapping changes and cause a stale physical translation to be used by the device. For the CVSS the PR:L value is used because reliable triggering requires local user execution and access to the GRU user interface, but not full administrative privileges. The issue is not network reachable and is highly hardware specific. Impact is at least local denial of service via crash or invalid device translation. In the worst case, stale page-table state may allow confidentiality or integrity impact through access to reused memory and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.