CVE-2026-97533 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems, especially those with module mapping spaces, should assess exposure and prioritize verification of affected systems.

Why it matters

A use-after-free vulnerability in the Linux kernel requires verification of affected systems and prompt application of patches or mitigations.

• Defenders should verify Linux kernel configurations and module mapping spaces for potential exposure.
• System updates and patches for the Linux kernel should be verified and applied.
• Monitoring system logs for suspicious activity related to page attribute changes is recommended.

Technical summary

The Linux kernel has a use-after-free vulnerability when changing page attributes. A lockless page table walker can obtain a PTE entry, which may later be written to via set_pte_atomic(). If a CPA collapse occurs concurrently, it can free the PTE that was retrieved, resulting in a use-after-free. The issue is resolved by acquiring an mmap read lock on init_mm over __change_page_attr_set_clr(). This change prevents the race condition by ensuring that the PTE entry is not freed while it is being written to. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with module mapping spaces.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with module mapping spaces.

Recommended defensive actions

• Review Linux kernel configurations and module mapping spaces for potential exposure.
• Verify system updates and patches for the Linux kernel.
• Monitor system logs for suspicious activity related to page attribute changes.
• Perform vulnerability assessments to identify potentially affected systems.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Assign an owner for follow-up on affected product deployments in managed environments.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions requires further verification by Linux kernel maintainers and users, especially those with module mapping spaces, to assess exposure and prioritize verification of affected systems. This includes verifying Linux kernel configurations, module mapping spaces, and system updates and patches for the Linux kernel. Monitoring system logs for suspicious activity related to page attribute changes is also recommended. The issue is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.