CVE-2026-99093

In the Linux kernel, the following vulnerability has been resolved:

mm: don't schedule deferred kernel page table freeing while booting

Booting with a boot-time function tracer and a filter, for example

ftrace=function ftrace filter=pud free pmd page

panics on 7.3-rc4 as soon as the tracer starts:

[ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010: queue work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] [ 26.413912] ? pagetable free kernel+0x20/0x120 [ 26.990283] queue work on+0x97/0xf0 [ 27.134382] cpa collapse large pages+0x501/0x6f0 [ 27.566662] cpa flush+0x394/0x620 [ 27.998953] change page attr set clr+0x321/0x4a0 [ 29.151729] set memory rox+0xa2/0xf0 [ 29.584018] create trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!

The boot-time tracer is started from early trace init(), which runs before workqueue init early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable free kernel(), which queues work on system percpu wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable free kernel() before the workqueue that function relies on exists.

Keep putting the table on the list, but don't schedule the work while the system is still booting. A core initcall schedules it once to free whatever was queued by then.