CVE-2026-97943

A flaw was found in the Linux kernel's x86 memory management subsystem. When collapsing memory page table entries into large pages, the kernel frees underlying page tables without holding the necessary lock to prevent concurrent page table walks. A local user can exploit this race condition to cause a denial of service (DoS) or potentially escalate privileges via a use-after-free condition.

An unlocked x86 CPA large page collapse can free lower level kernel page tables while ptdump or another CPA walker is still accessing them, creating a race and a use after free of page table memory. The directly supported impact is at least a local denial of service through an invalid page table access or kernel crash. Reuse of the freed page table memory may also create confidentiality or integrity impact and a potential privilege escalation path because the affected objects control kernel mappings, although a reliable arbitrary write primitive is not demonstrated. For the CVSS the PR:L value is used for the paranoid score because BPF, execmem, container root, or a delegated service may reach executable mapping changes without having unrestricted host administration rights. AC:H applies because successful triggering depends on winning a narrow race between page table collapse and a concurrent walker. The issue is not network reachable and requires local execution or control of a process that can reach the relevant CPA path. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to page table use after free and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.