In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't spin_trylock() in NMI on UP
Patch series "mm/page_alloc: fixes for free_pages_nolock() on RT/UP".
Pre-existing bugs found by Sashiko during review of this other series:
https://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/
I have not reproduced these bugs, and I suspect there is no real-world
user that is affected by them.
This patch (of 2):
As noted in can_spin_trylock(), using this is unsafe in this context.
commit 620b46ed6ae17 ("mm/page_alloc: return NULL early from
alloc_frozen_pages_nolock() in NMI on UP") fixed this on the alloc side
but missed the free side.
Impact: If BPF programs using these features in NMI (probably tracing) are
present on non-SMP builds this might crash the kernel and is probably
exploitable by local attackers for privilege escalation.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - free_pages_nolock is reached from local BPF programs (arena/bpf_map_alloc_pages and related nolock helpers) running in NMI, typically a BPF_PROG_TYPE_PERF_EVENT overflow handler installed via bpf()/perf_event_open. It is not reachable from unauthenticated network packets or in-kernel servers such as ksmbd/nfsd.
AC:L - Scoring assumes a uniprocessor (!CONFIG_SMP) kernel, a reasonable embedded/IoT deployment. An attacker who can attach a BPF perf-event program controls the NMI that calls free_pages_nolock and can concurrently run page-allocator work so the NMI interrupts zone->lock; the in-tree slub_kunit NMI overflow test shows this reentry is reliably triggerable.
PR:L - Loading the NMI BPF program requires CAP_BPF and CAP_PERFMON, which are sub-root capabilities. BPF tokens can delegate those checks into a non-init user namespace in plausible container/tracing deployments, so this is treated as low privileges rather than init-namespace root.
UI:N - The attacker loads the BPF program, programs the PMU, and drives local memory activity themselves. No separate victim action such as mounting a filesystem or opening a crafted file is required.
S:U - Re-entrant buddy/zone-lock corruption stays inside the kernel's own security authority and yields local privilege escalation, not a VM, IOMMU, or other cross-boundary escape.
C:H - Nested spin_trylock of zone->lock on UP lets the NMI mutate buddy freelists while the interrupted context is mid-update, corrupting page-allocator metadata. That overlapping-page primitive can be leveraged for arbitrary kernel memory disclosure.
I:H - The same freelist corruption is a well-known arbitrary-write and control-flow hijack primitive, and the fix commit states the bug is probably exploitable by local attackers for privilege escalation.
A:H - Re-entrant zone-lock and buddy updates crash the kernel via oops, panic, or a DEBUG_SPINLOCK BUG on UP, which is a full availability loss.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - free_pages_nolock is reached from local BPF programs (arena/bpf_map_alloc_pages and related nolock helpers) running in NMI, typically a BPF_PROG_TYPE_PERF_EVENT overflow handler installed via bpf()/perf_event_open. It is not reachable from unauthenticated network packets or in-kernel servers such as ksmbd/nfsd.
AC:L - Scoring assumes a uniprocessor (!CONFIG_SMP) kernel, a reasonable embedded/IoT deployment. An attacker who can attach a BPF perf-event program controls the NMI that calls free_pages_nolock and can concurrently run page-allocator work so the NMI interrupts zone->lock; the in-tree slub_kunit NMI overflow test shows this reentry is reliably triggerable.
PR:L - Loading the NMI BPF program requires CAP_BPF and CAP_PERFMON, which are sub-root capabilities. BPF tokens can delegate those checks into a non-init user namespace in plausible container/tracing deployments, so this is treated as low privileges rather than init-namespace root.
UI:N - The attacker loads the BPF program, programs the PMU, and drives local memory activity themselves. No separate victim action such as mounting a filesystem or opening a crafted file is required.
S:U - Re-entrant buddy/zone-lock corruption stays inside the kernel's own security authority and yields local privilege escalation, not a VM, IOMMU, or other cross-boundary escape.
C:H - Nested spin_trylock of zone->lock on UP lets the NMI mutate buddy freelists while the interrupted context is mid-update, corrupting page-allocator metadata. That overlapping-page primitive can be leveraged for arbitrary kernel memory disclosure.
I:H - The same freelist corruption is a well-known arbitrary-write and control-flow hijack primitive, and the fix commit states the bug is probably exploitable by local attackers for privilege escalation.
A:H - Re-entrant zone-lock and buddy updates crash the kernel via oops, panic, or a DEBUG_SPINLOCK BUG on UP, which is a full availability loss.
CVSS 3.1