CVE-2026-97942 (GCVE-0-2026-97942)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-10-19 09:11
VLAI
EPSS
VEX
Title
x86/alternatives: Exclude text poking against change_page_attr()
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/alternatives: Exclude text poking against change_page_attr()
From time to time, the following BUG can be observed
in the x86 alternatives patching code [0]:
> kernel BUG at arch/x86/kernel/alternative.c:2576!
> Oops: invalid opcode: 0000 [#1] SMP NOPTI
> CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022
> RIP: 0010:__text_poke+0x2aa/0x450
> Call Trace:
> <TASK>
> smp_text_poke_batch_finish+0x2a7/0x320
> __static_call_transform+0xb7/0x220
> arch_static_call_transform+0x5b/0xb0
> __static_call_init+0xe9/0x270
> static_call_module_notify+0x11f/0x150
> notifier_call_chain+0x61/0xe0
> blocking_notifier_call_chain_robust+0x63/0xc0
> load_module+0x1c92/0x20c0
> init_module_from_file+0xd8/0x140
> idempotent_init_module+0x100/0x2f0
> __x64_sys_finit_module+0x71/0xe0
> do_syscall_64+0xe1/0x610
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
which matches the following BUG_ON() in alternative.c:
/*
* If something went wrong, crash and burn since recovery paths are not
* implemented.
*/
BUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));
This can happen if vmalloc_to_page() fails, for any reason. Such can happen
if text poking races with CPA, which can possibly result in the collapsing
of page tables (or breaking of PMD hugepages). It is not a problem for most
users of vmalloc_to_page() (they solely own the vmalloc'd range) but, when
CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc
range, and can call set_memory_*() in parallel on it. This can happen to
race against __text_poke and cause havoc in vmalloc_to_page().
Fix it by excluding against CPA using the init_mm mmap read lock.
[ dhansen: Fix up SoB ordering. The actual code flow here was:
Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain
now. I *believe* Mike simply picked up Lorenzo's update to
Pedro's post from the Link ]
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d
(git)
Affected: 64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 89c60435b90d32ab5e3a39da3ae73d463d07debe (git) Affected: 64f6a4e10c05ed527f0f24b7954964255e0d3535 , < 1587d3394e254639cc36516256031334095e6ef3 (git) |
guessed | |
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/alternative.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
},
{
"lessThan": "89c60435b90d32ab5e3a39da3ae73d463d07debe",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
},
{
"lessThan": "1587d3394e254639cc36516256031334095e6ef3",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/alternative.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Exclude text poking against change_page_attr()\n\nFrom time to time, the following BUG can be observed\nin the x86 alternatives patching code [0]:\n\n \u003e kernel BUG at arch/x86/kernel/alternative.c:2576!\n \u003e Oops: invalid opcode: 0000 [#1] SMP NOPTI\n \u003e CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64\n \u003e Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n \u003e RIP: 0010:__text_poke+0x2aa/0x450\n \u003e Call Trace:\n \u003e \u003cTASK\u003e\n \u003e smp_text_poke_batch_finish+0x2a7/0x320\n \u003e __static_call_transform+0xb7/0x220\n \u003e arch_static_call_transform+0x5b/0xb0\n \u003e __static_call_init+0xe9/0x270\n \u003e static_call_module_notify+0x11f/0x150\n \u003e notifier_call_chain+0x61/0xe0\n \u003e blocking_notifier_call_chain_robust+0x63/0xc0\n \u003e load_module+0x1c92/0x20c0\n \u003e init_module_from_file+0xd8/0x140\n \u003e idempotent_init_module+0x100/0x2f0\n \u003e __x64_sys_finit_module+0x71/0xe0\n \u003e do_syscall_64+0xe1/0x610\n \u003e entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nwhich matches the following BUG_ON() in alternative.c:\n\n\t/*\n\t * If something went wrong, crash and burn since recovery paths are not\n\t * implemented.\n\t */\n\tBUG_ON(!pages[0] || (cross_page_boundary \u0026\u0026 !pages[1]));\n\nThis can happen if vmalloc_to_page() fails, for any reason. Such can happen\nif text poking races with CPA, which can possibly result in the collapsing\nof page tables (or breaking of PMD hugepages). It is not a problem for most\nusers of vmalloc_to_page() (they solely own the vmalloc\u0027d range) but, when\nCONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc\nrange, and can call set_memory_*() in parallel on it. This can happen to\nrace against __text_poke and cause havoc in vmalloc_to_page().\n\nFix it by excluding against CPA using the init_mm mmap read lock.\n\n[ dhansen: Fix up SoB ordering. The actual code flow here was:\n\t Pedro=\u003eLorenzo=\u003eMike=\u003eMe which is reflected in the SoB chain\n\t now. I *believe* Mike simply picked up Lorenzo\u0027s update to\n\t Pedro\u0027s post from the Link ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:11:08.757Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d"
},
{
"url": "https://git.kernel.org/stable/c/89c60435b90d32ab5e3a39da3ae73d463d07debe"
},
{
"url": "https://git.kernel.org/stable/c/1587d3394e254639cc36516256031334095e6ef3"
}
],
"title": "x86/alternatives: Exclude text poking against change_page_attr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97942",
"datePublished": "2026-09-25T10:22:54.188Z",
"dateReserved": "2026-09-25T10:18:58.204Z",
"dateUpdated": "2026-10-19T09:11:08.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-97942",
"date": "2026-11-02",
"epss": "0.00203",
"percentile": "0.10296"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/alternative.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
},
{
"lessThan": "89c60435b90d32ab5e3a39da3ae73d463d07debe",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
},
{
"lessThan": "1587d3394e254639cc36516256031334095e6ef3",
"status": "affected",
"version": "64f6a4e10c05ed527f0f24b7954964255e0d3535",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/alternative.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Exclude text poking against change_page_attr()\n\nFrom time to time, the following BUG can be observed\nin the x86 alternatives patching code [0]:\n\n \u003e kernel BUG at arch/x86/kernel/alternative.c:2576!\n \u003e Oops: invalid opcode: 0000 [#1] SMP NOPTI\n \u003e CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64\n \u003e Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n \u003e RIP: 0010:__text_poke+0x2aa/0x450\n \u003e Call Trace:\n \u003e \u003cTASK\u003e\n \u003e smp_text_poke_batch_finish+0x2a7/0x320\n \u003e __static_call_transform+0xb7/0x220\n \u003e arch_static_call_transform+0x5b/0xb0\n \u003e __static_call_init+0xe9/0x270\n \u003e static_call_module_notify+0x11f/0x150\n \u003e notifier_call_chain+0x61/0xe0\n \u003e blocking_notifier_call_chain_robust+0x63/0xc0\n \u003e load_module+0x1c92/0x20c0\n \u003e init_module_from_file+0xd8/0x140\n \u003e idempotent_init_module+0x100/0x2f0\n \u003e __x64_sys_finit_module+0x71/0xe0\n \u003e do_syscall_64+0xe1/0x610\n \u003e entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nwhich matches the following BUG_ON() in alternative.c:\n\n\t/*\n\t * If something went wrong, crash and burn since recovery paths are not\n\t * implemented.\n\t */\n\tBUG_ON(!pages[0] || (cross_page_boundary \u0026\u0026 !pages[1]));\n\nThis can happen if vmalloc_to_page() fails, for any reason. Such can happen\nif text poking races with CPA, which can possibly result in the collapsing\nof page tables (or breaking of PMD hugepages). It is not a problem for most\nusers of vmalloc_to_page() (they solely own the vmalloc\u0027d range) but, when\nCONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc\nrange, and can call set_memory_*() in parallel on it. This can happen to\nrace against __text_poke and cause havoc in vmalloc_to_page().\n\nFix it by excluding against CPA using the init_mm mmap read lock.\n\n[ dhansen: Fix up SoB ordering. The actual code flow here was:\n\t Pedro=\u003eLorenzo=\u003eMike=\u003eMe which is reflected in the SoB chain\n\t now. I *believe* Mike simply picked up Lorenzo\u0027s update to\n\t Pedro\u0027s post from the Link ]"
}
],
"id": "CVE-2026-97942",
"lastModified": "2026-10-19T10:17:45.403",
"metrics": {},
"published": "2026-09-25T11:17:21.633",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1587d3394e254639cc36516256031334095e6ef3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/281e6f536f2f3f95d91938c5bd7ba9bcb4c1049d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/89c60435b90d32ab5e3a39da3ae73d463d07debe"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-17T21:44:05+00:00",
"cve": "CVE-2026-97942",
"id": "CVE-2026-97942",
"initial_release_date": "2026-09-25T00:00:00+00:00",
"product_status:known_affected": "91",
"product_status:known_not_affected": "186",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: x86/alternatives: Exclude text poking against change_page_attr()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97942.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.