{"id":"CVE-2026-97525","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Allocate split page tables as kernel page tables\n\nA PTE is allocated directly without going through the standard page table\nallocation routines (such as pte…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Allocate split page tables as kernel page tables\n\nA PTE is allocated directly without going through the standard page table\nallocation routines (such as pte…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= b3039c526f3e1744db0cbb7ae1f0213f5e27d3f4 < 84e0cd79d57f06b872154eb5d8f610584133f260","Linux >= 5ba2f0a1556479638ac11a3c201421f5515e89f5 < 922873cf4fc34124215070a8ad391bf831538bb9","Linux >= 5ba2f0a1556479638ac11a3c201421f5515e89f5 < 9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4","Linux >= 6.18.7 < 6.18.53","Linux 6.19"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:17:57.917","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97525","references":[{"url":"https://git.kernel.org/stable/c/84e0cd79d57f06b872154eb5d8f610584133f260","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/922873cf4fc34124215070a8ad391bf831538bb9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e4a3ec3411bb6bb59e3c1f29b75609f1e87aac4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.926Z","slug":"CVE-2026-97525","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Allocate split page tables as kernel page tables\n\nA PTE is allocated directly without going through the standard page table\nallocation routines (such as pte_alloc_one_kernel()) when the CPA code\nsplits a large page (__split_large_page()).\n\nThis means the page table constructor is never called nor is the page table\nmarked as a kernel page table.\n\nThe former results in the folio associated with the page table not being\nmarked as a page table (__pagetable_ctor() is never called thus neither is\n__folio_set_pgtable()) nor are statistics updated to reflect\nit (lruvec_stat_add_folio() is never called).\n\nThe latter issue of failing to mark the page table as a kernel page\ntable (ptdesc_set_kernel() is never called) is far more problematic.\n\nSince commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nkernel page table freeing has been batched and since the\nsubsequent commit:\n\n  e37d5a2d60a3 (\"iommu/sva: invalidate stale IOTLB entries for kernel address space\")\n\nIOTLB cache entries for kernel page tables have been invalidated upon\nbeing freed.\n\nSince split page tables are freed without this invalidation, the IOTLB\ncan contain stale entries for them.\n\nResolve the issue by using the ordinary PTE allocation API at split time.\n\nThis results in these kernel page tables invoking a page table constructor,\nand thus requires a page table destructor.\n\nDestructors are not always present, like for early allocated direct map\npage tables). Conditionally call pagetable_dtor_free() if the PG_table\nfolio flag for the ptdesc is set, otherwise we free the page table via\npagetable_free().\n\nRegardless of which path is taken page tables marked as kernel page tables,\nwhich now includes split page tables, take the correct route through\npagetable_free_kernel().\n\nThere is a user-visible side effect in that split page tables will appear\nin nr_page_table_pages in /proc/vmstat (as do other kernel page tables\nallocated after early boot), however this is a positive change.\n\nThis issue started being markedly problematic after commit:\n\n  5ba2f0a15564 (\"mm: introduce deferred freeing for kernel page tables\")\n\nso choose this as the Fixes target.\n\n[ dhansen: rephrase in imperative mood ]\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":211016,"id":"CVE-2026-97525","ts":1790349124117,"field":"cvss","old":null,"new":"8.2"},{"seq":211015,"id":"CVE-2026-97525","ts":1790349124117,"field":"severity","old":"none","new":"high"}]}