CVE-2026-97525 Linux CVE debrief

Who should care

Defenders and administrators responsible for Linux kernel systems should assess exposure and prioritize verification of Linux kernel versions, especially those with recent updates. Review and apply patches as necessary. This includes checking for recent updates and applying patches as necessary. System configurations may need to be reviewed and updated to ensure exposure.

Why it matters

A Linux kernel vulnerability was resolved, addressing an issue with split page table allocation. Defenders should assess exposure and prioritize verification of Linux kernel versions.

• Verification of Linux kernel versions is necessary to ensure exposure
• Applying patches may be necessary to resolve the issue
• System configurations may need to be reviewed and updated

Technical summary

The Linux kernel's page table constructor was not being called, and page tables were not marked as kernel page tables, leading to potential IOTLB cache issues. This issue became problematic after a specific commit introduced deferred freeing for kernel page tables. The resolution involves using the ordinary PTE allocation API at split time, invoking a page table constructor, and thus requires a page table destructor. Destructors are not always present, like for early allocated direct map page tables. Conditionally call pagetable_dtor_free() if the PG_table folio flag for the ptdesc is set, otherwise we free the page table via pagetable_free().

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel versions, especially those with recent updates. Review and apply patches as necessary.

Recommended defensive actions

• Assess Linux kernel versions for exposure
• Verify and apply patches as necessary
• Review system configurations and update documentation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and Linux kernel source references provide details on the vulnerability and its resolution. Evidence is limited to official records and source references. Defenders should verify Linux kernel versions and review system configurations for exposure. This includes checking for recent updates and applying patches as necessary. The issue became markedly problematic after a specific commit introduced deferred freeing for kernel page tables.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.