CVE-2026-90201

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the net: page pool component. The problem occurs due to a race condition during xa cmpxchg when page pool destroy() executes page pool scrub() concurrently with a page return via page pool put netmem() on a different CPU. Specifically, the function page pool release netmem dma() reads and writes netmem fields, such as dma addr and DMA index bits in pp magic, after xa cmpxchg() returns. If the unref path loses the xa cmpxchg race, it may free the page via put page() before the scrub winner completes its netmem accesses, leading to a Use-After-Free scenario where the scrub path accesses a freed page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.