Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor builds

Impact

free_pages_nolock() used spin_trylock() in NMI context, which the allocator's own can_spin_trylock() documents as unsafe; the matching fix on the allocation side had already landed and the free side was missed. The upstream note says a BPF program using these features from NMI (typically tracing) on a non-SMP build may crash the kernel and is probably exploitable locally for privilege escalation. The author states they did not reproduce it and suspects no real-world user is affected. For a GPU fleet the exposure is effectively nil in practice: datacenter nodes are SMP builds, so the affected path does not exist there - carry the fix with the next kernel rather than opening a window for it.

Who can reach it

Local user able to load BPF programs that attach in NMI context, on a CONFIG_SMP=n kernel. Requires local privileges to load BPF; not reachable remotely and not reachable at all on SMP builds.

What to do

Pick up the stable kernel carrying commits 06c76d3c389f / 3105ae628fb7 / 68a069b40730 on the normal patch cadence; applying it means a node drain and reboot. No standalone mitigation is published, but restricting unprivileged BPF removes the trigger, and SMP kernels are unaffected.

References

Related entries

• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High
• Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High