{"id":25610,"date":"2026-09-18T04:31:38","date_gmt":"2026-09-17T20:31:38","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90201"},"modified":"2026-09-18T04:31:38","modified_gmt":"2026-09-17T20:31:38","slug":"cve-2026-90201","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90201","title":{"rendered":"CVE-2026-90201 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: page_pool: fix U"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race<\/p>\n<p>This bug was discovered while testing the hns3 driver under channel<br \/>\nreconfiguration (`ethtool -L` \/ `ethtool -G`) with iperf3 traffic on<br \/>\narm64. The race is intermittently triggered when page_pool_destroy()<br \/>\nruns page_pool_scrub() concurrently with page return via<br \/>\npage_pool_put_netmem() on a different CPU. A WARN in<br \/>\npage_pool_clear_pp_info() surfaced the dangling DMA index bits left<br \/>\nby the cmpxchg loser, which led to the investigation.<\/p>\n<p>page_pool_scrub() iterates pool-&gt;dma_mapped via xa_for_each() with no<br \/>\npage ref held. __page_pool_release_netmem_dma() currently reads and<br \/>\nwrites netmem fields (dma_addr, DMA index bits in pp_magic) after<br \/>\nxa_cmpxchg() returns. The unref path calls put_page() unconditionally<br \/>\nregardless of the cmpxchg outcome; when it loses the cmpxchg, it still<br \/>\nfrees the page before the scrub winner finishes these netmem accesses,<br \/>\nso scrub touches a freed page &#8212; a Use-After-Free.<\/p>\n<p>Fix this by splitting the DMA release into two functions:<\/p>\n<p>1. __page_pool_unmap_netmem_dma() caches dma_addr before xa_cmpxchg(),<br \/>\n   does the cmpxchg to remove the DMA mapping, and calls dma_unmap on<br \/>\n   the cached address. It never touches netmem fields after the cmpxchg,<br \/>\n   making it safe for the scrub path which holds no page ref.<\/p>\n<p>2. __page_pool_release_netmem_dma() wraps the above and additionally<br \/>\n   clears dma_addr and DMA index bits in netmem fields. This is safe<br \/>\n   only when the caller holds a page ref, so it is used by the return<br \/>\n   path (page_pool_return_netmem).<\/p>\n<p>The scrub path calls __page_pool_unmap_netmem_dma() directly; the return<br \/>\npath calls __page_pool_release_netmem_dma().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race<\/p>\n<p>This bug was discovered while testing the hns3 driver<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25610","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}