CVE-2026-90046 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of Linux-based systems, especially those using BPF programs in NMI on non-SMP builds, and security teams responsible for vulnerability management. These stakeholders should assess exposure, verify patch application, and monitor for exploitation attempts. They should also review compensating controls and track exceptions for exposed systems.

Why it matters

This vulnerability in the Linux kernel could lead to system crashes and potential local privilege escalation on non-SMP builds if BPF programs use certain features in NMI. Defenders should assess exposure, verify patch application, and monitor for exploitation attempts.

• Potential system crash in non-SMP Linux kernel builds when BPF programs use certain features in NMI
• Possible local privilege escalation by attackers
• Need for verification of official patch application
• Limited information available on real-world impact and affected user bases

Technical summary

The vulnerability is in the mm/page_alloc component of the Linux kernel, specifically related to spin_trylock() usage in NMI on UP. This could lead to a crash if BPF programs using certain features in NMI are present on non-SMP builds. The issue was identified through review of a patch series for free_pages_nolock() on RT/UP. The patch series addressed pre-existing bugs found by Sashiko. The impact includes potential system crashes and local privilege escalation. The Linux kernel maintainers and administrators should assess exposure and verify patch application.

Defensive priority

Assess exposure in Linux kernel deployments, especially those using BPF programs in NMI on non-SMP builds, and verify if official patches are applied.

Recommended defensive actions

• Assess Linux kernel deployments for non-SMP builds using BPF programs in NMI
• Verify application of official patches
• Monitor for local privilege escalation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its real-world impact and exploitation are not confirmed. Limited information is available on affected versions and user bases. The vulnerability was resolved in a patch series addressing mm/page_alloc fixes for free_pages_nolock() on RT/UP. The patch series was reviewed and changes were made based on Sashiko's findings. The Linux kernel maintainers and administrators should verify patch application and monitor for exploitation attempts. Evidence of exploitation or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.