{"id":28503,"date":"2026-09-25T00:31:34","date_gmt":"2026-09-24T16:31:34","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93239"},"modified":"2026-09-25T00:31:34","modified_gmt":"2026-09-24T16:31:34","slug":"cve-2026-93239","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93239","title":{"rendered":"CVE-2026-93239 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix the lo"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>arm64: mm: Fix the lockless page-table walk in show_pte()<\/p>\n<p>show_pte() walks page tables locklessly and can run with interrupts<br \/>\nenabled. A concurrent teardown can free a table page while it is being<br \/>\nwalked. It can also clear a parent entry after show_pte() checked it; the<br \/>\nregular pXd_offset() helpers then reread the cleared entry and can derive a<br \/>\nbogus lower-level pointer and fault again.<\/p>\n<p>Use the lockless offset helpers with the saved parent entries, as<br \/>\ngup_fast() does, and pass the saved PMD to pte_offset_map().<\/p>\n<p>For task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable<br \/>\nlocal interrupts around the walk to hold off RCU-deferred table frees and<br \/>\nblock the tlb_remove_table_sync_one() IPI until the walk is finished.<\/p>\n<p>Place the IRQ guard after the header print. This does not make the output a<br \/>\nconsistent snapshot, but prevents the task page-table walk from<br \/>\ndereferencing a released table page or deriving a pointer from a different<br \/>\nparent value.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>arm64: mm: Fix the lockless page-table walk in show_pte()<\/p>\n<p>show_pte() walks page tables locklessly and can run with interrupts<br \/>\nenab<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28503","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28503","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28503"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28503"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28503"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}