CVE-2026-90046: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-90046 Overview

CVE-2026-90046 is a Linux kernel vulnerability in the memory management subsystem. The flaw resides in free_pages_nolock() within mm/page_alloc, which unsafely calls spin_trylock() from Non-Maskable Interrupt (NMI) context on uniprocessor (UP) builds. A prior fix addressed the allocation path but missed the corresponding free path. Berkeley Packet Filter (BPF) programs invoking these code paths from NMI context, typically for tracing, can trigger kernel instability on non-SMP kernels.

Critical Impact
Local attackers on affected non-SMP Linux systems may crash the kernel or potentially escalate privileges through BPF tracing programs executing in NMI context.

Affected Products

Linux kernel builds with uniprocessor (UP, non-SMP) configuration
Kernels containing commit 620b46ed6ae17 without the corresponding free-side fix
Systems permitting BPF tracing programs to run in NMI context

Discovery Timeline

2026-09-16 - CVE-2026-90046 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90046

Vulnerability Analysis

The vulnerability affects the Linux kernel page allocator's free_pages_nolock() function. This helper is invoked when memory must be freed from restricted contexts, including NMI handlers. On uniprocessor kernels, calling spin_trylock() from NMI context is unsafe because the lock implementation relies on assumptions that do not hold when interrupts cannot be masked. The helper can_spin_trylock() documents this constraint.

Commit 620b46ed6ae17 ("mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP") resolved the equivalent issue on the allocation side. The free side retained the unsafe spin_trylock() call, leaving free_pages_nolock() exposed. BPF programs attached to tracing hooks that trigger memory frees from NMI context can reach this path.

Root Cause

The root cause is an inconsistent fix scope. Developers hardened the allocator entry point but left the symmetric free path calling spin_trylock() from a context where the operation is not safe on UP builds. This falls under [CWE-662] concurrency issues combined with kernel-context violations.

Attack Vector

Exploitation requires local access and the ability to load or trigger BPF programs that free pages from NMI context on a UP kernel. A local, low-privileged attacker capable of reaching the vulnerable code path can crash the kernel. The advisory notes potential privilege escalation, though no public proof of concept is available. The fix is distributed across kernel commits 06c76d3c389ff504052f64b1acee44651bd847fa, 3105ae628fb785d48b49256468be4f21a7b3cfc0, and 68a069b407303e71db371df85036101e8ff59280.

// No verified exploit code is available.
// See kernel commits referenced above for the corrected free_pages_nolock() logic.

Detection Methods for CVE-2026-90046

Indicators of Compromise

Unexpected kernel panics or oops messages referencing free_pages_nolock, spin_trylock, or NMI handlers on UP kernels
Repeated crashes correlated with BPF tracing program loads or attachments
Kernel log entries showing lock-related warnings originating from mm/page_alloc.c

Detection Strategies

Audit running kernels for UP configuration (CONFIG_SMP=n) combined with BPF and kprobe/tracing support enabled
Monitor bpf() syscall usage by unprivileged or minimally privileged local users
Correlate BPF program load events with subsequent kernel instability in centralized logging

Monitoring Recommendations

Ingest dmesg, /var/log/kern.log, and kernel crash dumps into a centralized SIEM or data lake for pattern analysis
Alert on new BPF programs attaching to tracepoints or perf events on production hosts
Track kernel version and build configuration inventory to identify UP systems requiring priority patching

How to Mitigate CVE-2026-90046

Immediate Actions Required

Inventory Linux systems and identify any built with CONFIG_SMP=n (uniprocessor kernels)
Apply upstream kernel updates that include the referenced fix commits as soon as vendor releases are available
Restrict BPF program loading to trusted administrators by enforcing kernel.unprivileged_bpf_disabled=1

Patch Information

The fix is available in the mainline Linux kernel through commits Kernel Git Commit 06c76d3, Kernel Git Commit 3105ae6, and Kernel Git Commit 68a069b. Distribution maintainers will backport these to supported stable kernel branches. Deploy the vendor-provided kernel update and reboot affected systems.

Workarounds

Rebuild affected kernels with CONFIG_SMP=y where hardware supports it, as the unsafe path is specific to UP builds
Disable unprivileged BPF via sysctl -w kernel.unprivileged_bpf_disabled=1 to reduce the attack surface
Limit tracing subsystem access using Linux capabilities and remove CAP_BPF/CAP_PERFMON from non-administrative users

bash

# Reduce BPF-related attack surface until kernel is patched
sysctl -w kernel.unprivileged_bpf_disabled=1
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.d/99-bpf-hardening.conf

# Verify current kernel configuration for SMP
zcat /proc/config.gz 2>/dev/null | grep CONFIG_SMP