In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpa_lock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes: BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 Write of size 8 at addr ffff888181139718 by task modprobe ... The buggy address belongs to the physical page: pfn:0x181139 ... page_type: f2(table) cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD: CPU A (module load) CPU B (module finalize) ------------------- ----------------------- execmem_make_temp_rw set_memory_nx __change_page_attr split 2M -> 4K table P kpte = &P[i] (lockless) execmem_restore_rox set_memory_rox (CPA_COLLAPSE) cpa_collapse_large_pages rebuild leaf PMD flush_tlb_all pagetable_free(P) set_pte_atomic(kpte, ...) -> writes into freed P P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text. The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P. Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86/mm/pat: Take cpa_lock around large-page collapse Loading and unloading modules concurrently on several     CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window,     faults within minutes: BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 Write of size 8 at     addr ffff888181139718 by task modprobe ... The buggy address belongs to the physical page: pfn:0x181139     ... page_type: f2(table) cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old     PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless     lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served     from a shared large ROX mapping the two run on the same PMD: CPU A (module load) CPU B (module finalize)
    ------------------- ----------------------- execmem_make_temp_rw set_memory_nx __change_page_attr split 2M
    -> 4K table P kpte = &P[i] (lockless) execmem_restore_rox set_memory_rox (CPA_COLLAPSE)     cpa_collapse_large_pages rebuild leaf PMD flush_tlb_all pagetable_free(P) set_pte_atomic(kpte, ...) ->     writes into freed P P is a page-table page (page_type: table), reused at once, so the write corrupts     whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into     read-only text. The flush_tlb_all() before the free does not close this: its IPI only serializes against     page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs     with interrupts on, so nothing stops it from holding a stale pointer into P. Serialize the collapse - the     PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes     unconditionally since commit (x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()), so a     concurrent walker can no longer hold a pointer into a table the collapse is about to free.
    (CVE-2026-93066)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372022	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22167-1)	Nessus	SuSE Local Security Checks	Local	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	medium
347459	Linux Distros Unpatched Vulnerability : CVE-2026-93066	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93066

high

Tenable Plugins

high

medium

high