CVE-2026-97533

A flaw was found in the Linux kernel's x86 Page Attribute Table (PAT) memory management subsystem. A race condition occurs when memory attributes are changed concurrently with page table collapse operations, allowing the kernel to access memory after it has been freed. A local user could exploit this use-after-free vulnerability to potentially escalate privileges or crash the system, resulting in a Denial of Service (DoS).

A race between a lockless CPA page table walk and concurrent CPA collapse can free the page table that contains a previously obtained PTE. A later set_pte_atomic call can then write through the stale PTE pointer, resulting in a use after free write and possible corruption of reused kernel memory. Reliable triggering requires winning a timing window, therefore AC:H is appropriate. For the CVSS the PR:L value is used for the paranoid case because a local user may be able to trigger module autoload or another kernel operation that indirectly reaches the relevant CPA paths without full administrative control. The base case uses PR:H because direct control of module mapping and memory attribute changes is normally privileged. The issue is not directly network reachable. Impact is at least a local denial of service through memory corruption and a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.