Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor builds

Impact

free_pages_nolock() used spin_trylock() in NMI context, which the allocator's own can_spin_trylock() documents as unsafe; the matching fix on the allocation side had already landed and the free side was missed. The upstream note says a BPF program using these features from NMI (typically tracing) on a non-SMP build may crash the kernel and is probably exploitable locally for privilege escalation. The author states they did not reproduce it and suspects no real-world user is affected. For a GPU fleet the exposure is effectively nil in practice: datacenter nodes are SMP builds, so the affected path does not exist there - carry the fix with the next kernel rather than opening a window for it.

Who can reach it

Local user able to load BPF programs that attach in NMI context, on a CONFIG_SMP=n kernel. Requires local privileges to load BPF; not reachable remotely and not reachable at all on SMP builds.

What to do

Pick up the stable kernel carrying commits 06c76d3c389f / 3105ae628fb7 / 68a069b40730 on the normal patch cadence; applying it means a node drain and reboot. No standalone mitigation is published, but restricting unprivileged BPF removes the trigger, and SMP kernels are unaffected.

References

Related entries

• Linux kernel acomp: stack-request clone is undersized, letting async offload drivers write past the slab objectCVE-2026-90069 · Linux kernel crypto acomp (ACOMP_REQUEST_ON_STACK request cloning)High
• Linux kernel XDP: BPF_LINK_UPDATE bypasses offload checks, putting a device-bound program on the software pathCVE-2026-90146 · Linux kernel bpf/xdp (bpf_xdp_link_update offload checks)High
• Linux kernel BPF verifier (atomic RMW destination pointer type tracking): The verifier recorded an instruction'sCVE-2026-90177 · Linux kernel BPF verifier (atomic RMW destination pointer type tracking)High
• Linux kernel BPF: use-after-free when multi-attach trampoline update fails and the still-live old image is freedCVE-2026-90210 · Linux kernel BPF trampoline (bpf_trampoline_multi_attach_free on update failure)High
• Linux kernel BPF verifier: iterator stack slots compared without pointer type, pruning an unsafe pathCVE-2026-90217 · Linux kernel BPF verifier (STACK_ITER slot type comparison during state pruning)High
• Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handlesCVE-2026-90227 · Linux kernel NVMe ioctl (NVME_IOCTL_SUBMIT_IO missing nvme_cmd_allowed() check)High