CVE-2026-90383 (GCVE-0-2026-90383)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:54
VLAI
Title
misc: sgi-gru: remove interrupt-context page-table walks
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user page tables and supports only PMD-level large mappings on x86-64. Remove the direct walker. Send interrupt faults directly to user polling mode so the existing call-OS fallback retries them in process context. Remove the mmap-lock failure statistic that can no longer be incremented.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 142586409c8be7dc071bb94d7cd2d69ccfd99b6b , < 877423f595b60f8fe7c18b64a5d283d9e1732a13 (git)
Affected: 142586409c8be7dc071bb94d7cd2d69ccfd99b6b , < 6248eb1833ff0adfdbbadd5f846c2f22e02a01b0 (git)
Affected: 142586409c8be7dc071bb94d7cd2d69ccfd99b6b , < ef81e4a1628ecfb9cfc442de10883f383faf17a1 (git)
Affected: 142586409c8be7dc071bb94d7cd2d69ccfd99b6b , < 928a8e9f523df845fc496bcb9811013b67aabec5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/sgi-gru/grufault.c",
            "drivers/misc/sgi-gru/gruprocfs.c",
            "drivers/misc/sgi-gru/grutables.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "877423f595b60f8fe7c18b64a5d283d9e1732a13",
              "status": "affected",
              "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
              "versionType": "git"
            },
            {
              "lessThan": "6248eb1833ff0adfdbbadd5f846c2f22e02a01b0",
              "status": "affected",
              "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
              "versionType": "git"
            },
            {
              "lessThan": "ef81e4a1628ecfb9cfc442de10883f383faf17a1",
              "status": "affected",
              "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
              "versionType": "git"
            },
            {
              "lessThan": "928a8e9f523df845fc496bcb9811013b67aabec5",
              "status": "affected",
              "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/sgi-gru/grufault.c",
            "drivers/misc/sgi-gru/gruprocfs.c",
            "drivers/misc/sgi-gru/grutables.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: sgi-gru: remove interrupt-context page-table walks\n\nThe GRU TLB miss handler walks a process\u0027s page tables without holding\npage-table locks or a reference to the mapped page. It also uses a kernel\npage-table accessor on user page tables and supports only PMD-level large\nmappings on x86-64.\n\nRemove the direct walker. Send interrupt faults directly to user polling\nmode so the existing call-OS fallback retries them in process context.\n\nRemove the mmap-lock failure statistic that can no longer be incremented."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker supplies the faulting VA by writing a virtual-mode GRU vload/vstore/bcopy into the mmap\u0027d GSEG on /dev/gru. gru_fault loads the context; the miss is handled by gru_intr (default GRU_OPT_MISS_FMM_INTR) or ioctl GRU_USER_CALL_OS (gru_handle_user_call_os), both of which called atomic_pte_lookup on that missvaddr.\nAC:L - gru_create_new_context defaults to GRU_OPT_MISS_FMM_INTR, so a mapped-mode GRU instruction reliably hits gru_intr, which mmap_read_trylocks gts-\u003ets_mm and runs atomic_pte_lookup. A 1GB hugetlb VMA is mis-walked with no race because pud_leaf is never checked; a second thread of the same process can also madvise/unmap during the unlocked walk.\nPR:L - gru_fops has no .open method and gru_file_mmap/gru_file_unlocked_ioctl do not call capable(). An unprivileged process that can open miscdevice \"gru\" (/dev/gru) can mmap the GSEG, ioctl GRU_CREATE_CONTEXT, and issue GRU instructions that reach atomic_pte_lookup; only gru_unload_all_contexts requires CAP_SYS_ADMIN.\nUI:N - The attacker alone opens /dev/gru, maps the GSEG, calls GRU_CREATE_CONTEXT, and issues the GRU instruction or GRU_USER_CALL_OS ioctl; no other user needs to act.\nS:U - atomic_pte_lookup feeds a GPA to tfh_write_restart on the host GRU chiplet. A bad PFN lets GRU DMA into host kernel or other-process memory, which is privilege escalation in the same kernel authority, not a guest-to-host or IOMMU-domain crossing.\nC:H - atomic_pte_lookup never tests pud_leaf, so pud_pgtable() on a 1GB hugetlb leaf treats attacker-controlled hugepage bytes as PMD/PTE entries. pte_pfn of that crafted entry is installed by tfh_write_restart, and gru_vload/bcopy then reads that physical page into the attacker-mapped GSEG. The walk also never pins the page, so a stale PFN can be read after reuse.\nI:H - gru_vstore, gru_bcopy, and AMO opcodes write through the GRU TLB entry programmed by tfh_write_restart. A PFN taken from the pud_leaf miswalk of attacker-controlled 1GB hugepage contents, or from an unpinned PTE reused after free, is therefore an arbitrary physical write.\nA:H - pte_offset_kernel() on a pud_leaf 1GB mapping (or on a PMD that is not a table) computes __va of a non-page-table PFN and dereferences it in gru_intr/atomic_pte_lookup, oopsing the kernel. GRU DMA through a stale unpinned PFN can also panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:59.978Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/877423f595b60f8fe7c18b64a5d283d9e1732a13"
        },
        {
          "url": "https://git.kernel.org/stable/c/6248eb1833ff0adfdbbadd5f846c2f22e02a01b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef81e4a1628ecfb9cfc442de10883f383faf17a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/928a8e9f523df845fc496bcb9811013b67aabec5"
        }
      ],
      "title": "misc: sgi-gru: remove interrupt-context page-table walks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90383",
    "datePublished": "2026-09-17T16:09:19.875Z",
    "dateReserved": "2026-09-11T19:38:34.809Z",
    "dateUpdated": "2026-09-18T17:54:59.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90383",
      "date": "2026-09-29",
      "epss": "0.00175",
      "percentile": "0.06273"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:47:23.000Z",
      "cve": "CVE-2026-90383",
      "id": "msrc_CVE-2026-90383",
      "initial_release_date": "2026-09-19T01:06:18.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "misc: sgi-gru: remove interrupt-context page-table walks",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90383.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/sgi-gru/grufault.c",
                  "drivers/misc/sgi-gru/gruprocfs.c",
                  "drivers/misc/sgi-gru/grutables.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "877423f595b60f8fe7c18b64a5d283d9e1732a13",
                    "status": "affected",
                    "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6248eb1833ff0adfdbbadd5f846c2f22e02a01b0",
                    "status": "affected",
                    "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ef81e4a1628ecfb9cfc442de10883f383faf17a1",
                    "status": "affected",
                    "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "928a8e9f523df845fc496bcb9811013b67aabec5",
                    "status": "affected",
                    "version": "142586409c8be7dc071bb94d7cd2d69ccfd99b6b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/sgi-gru/grufault.c",
                  "drivers/misc/sgi-gru/gruprocfs.c",
                  "drivers/misc/sgi-gru/grutables.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.27"
                  },
                  {
                    "lessThan": "2.6.27",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: sgi-gru: remove interrupt-context page-table walks\n\nThe GRU TLB miss handler walks a process\u0027s page tables without holding\npage-table locks or a reference to the mapped page. It also uses a kernel\npage-table accessor on user page tables and supports only PMD-level large\nmappings on x86-64.\n\nRemove the direct walker. Send interrupt faults directly to user polling\nmode so the existing call-OS fallback retries them in process context.\n\nRemove the mmap-lock failure statistic that can no longer be incremented."
          }
        ],
        "id": "CVE-2026-90383",
        "lastModified": "2026-09-18T18:17:56.450",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:37.660",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6248eb1833ff0adfdbbadd5f846c2f22e02a01b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/877423f595b60f8fe7c18b64a5d283d9e1732a13"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/928a8e9f523df845fc496bcb9811013b67aabec5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ef81e4a1628ecfb9cfc442de10883f383faf17a1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.