CVE-2026-90046

The Linux kernel's page allocator free path (free_pages_nolock()) performs an unsafe spin_trylock() when running in NMI context on uniprocessor (non-SMP) kernel builds; a prior fix (commit 620b46ed6ae17) addressed the allocation side but missed the free side. The flaw is triggered when BPF programs that use these page-allocation/freeing features in NMI context — most plausibly BPF tracing programs — run on a non-SMP kernel. A local attacker who can load such BPF programs could crash the kernel, and the reporter assesses it is probably exploitable for local privilege escalation. Only non-SMP/UP kernel builds are affected, and the patch author states the bugs were found by code review, have not been reproduced, and that no real-world user is suspected to be affected. No public proof-of-concept is known, the issue is not in CISA KEV, and there are no reports of exploitation in the wild.

What to do: Apply the upstream mm/page_alloc fix from the 'fixes for free_pages_nolock() on RT/UP' patch series (patch 1 of 2) once it lands in mainline and stable trees for your kernel version. Operators of non-SMP/UP kernels (embedded, IoT, minimal single-vCPU systems) should audit whether BPF programs using NMI-context tracing/allocation features are loaded and restrict unprivileged BPF if so. SMP kernel builds are not affected.