Linux kernel x86/shstk: recursive mmap lock during shadow stack sigreturn can deadlock the task

Impact

During sigreturn the kernel pops the shadow stack signal frame by reading userspace while holding the mmap read lock so it can verify the VMA flags. If that read takes a page fault, the fault handler tries to take the mmap read lock again; with a writer waiting on another CPU the second read lock can fail and deadlock. A local user on a kernel built with X86_USER_SHADOW_STACK can therefore wedge a task in an unkillable state under the right timing, which on a shared GPU node means a stuck process that may hold GPU memory or device file descriptors and a node that needs draining rather than a simple job kill. Only kernels with user shadow stack (Intel CET) enabled and processes actually using it are affected.

Who can reach it

Local user running a process with x86 user shadow stack enabled, taking a signal whose sigreturn faults while another thread holds or waits for the mmap write lock. No authentication beyond code execution on the node; no remote path.

What to do

Update the kernel to a stable release containing the fix (the userspace read now happens without the mmap lock held, with mmap_lock_speculate_*() used to detect concurrent writers and retry) and reboot each node. Note the fix makes X86_USER_SHADOW_STACK depend on PER_VMA_LOCK, so non-SMP shadow stack configurations lose support. Where shadow stack is not required, building or booting without user shadow stack removes the exposure.

References

Related entries

• Linux kernel KVM SVM: INVLPGA does not raise #UD with EFER.SVME clearCVE-2026-46082 · Linux kernel KVM SVM (INVLPGA #UD injection when EFER.SVME=0)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): Memory is handed to a consumer without beingCVE-2026-46229 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• polkit: unbounded stdin read in polkit-agent-helper-1 lets a local user exhaust system memoryCVE-2026-4897 · polkit polkit-agent-helper-1 (unbounded read from stdin in the setuid helper)Medium
• Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace): The connection-info walkers handCVE-2026-52995 · Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace)Medium
• Linux kernel BPF: clearing a large PROG_ARRAY map stalls RCU and can hang the CPUCVE-2026-53083 · Linux kernel BPF (bpf_fd_array_map_clear, PROG_ARRAY teardown)Medium
• Linux drm/xe GPU kernel driver (suspend/shutdown without display): The xe driver oopses on suspend or shutdownCVE-2026-53142 · Linux drm/xe GPU kernel driver (suspend/shutdown without display)Medium