CVE-2026-97943: Linux kernel · x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in a1c7570cedd03372812a5b693732880867babbca : patch Linux kernel soon.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in a1c7570cedd03372812a5b693732880867babbca, 35820cf8dd521f5a651e221483015b0586794516, 93b98882198b15bd482da1fe8e84b05c7c3b3d83
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to a1c7570cedd03372812a5b693732880867babbca, 35820cf8dd521f5a651e221483015b0586794516 or 93b98882198b15bd482da1fe8e84b05c7c3b3d83.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel. The issue is resolved by acquiring the init_mm write lock during the collapse operation to prevent concurrent access to freed page tables. Users should update to a fixed kernel version containing the commits identified (e.g., those with hashes a1c7570cedd03372812a5b693732880867babbca, 35820cf8dd521f5a651e221483015b0586794516, 93b98882198b15bd482da1fe8e84b05c7c3b3d83).
Description
A use-after-free (UAF) vulnerability exists in the Linux kernel's x86 memory management related to page attribute modification. The issue arises during the collapse of kernel page table entries into huge page entries without holding the necessary write lock, potentially causing concurrent access to freed page tables. This flaw affects the set_memory_rox() function, used by execmem and BPF for executable memory mappings. The vulnerability is fixed by acquiring the init_mm write lock during the collapse operation to prevent concurrent races and UAF conditions.