{
  "cveId": "CVE-2026-93237",
  "url": "https://patchblox.com/security/cve/CVE-2026-93237",
  "summary": "CVE-2026-93237 is fixed in linux on 1 platform by DEBIAN-CVE-2026-93237 (version 7.2.6-1), released September 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "LoongArch: Add DIRECT_MAP_PHYSMEM_END definition",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  LoongArch: Add DIRECT_MAP_PHYSMEM_END definition  get_free_mem_region() and mhp_get_pluggable_range() bound their search to DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback in include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is (1ULL \u003C\u003C MAX_PHYSMEM_BITS) - 1, a compile-time constant that does not adapt to the CPU\u0027s physical address space bits (cpu_pabits, probed from CPUCFG1).  The vmemmap window only covers physical space below 2^(cpu_pabits\u002B1) (i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than MAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return a ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then wraps the memmap range around and maps it into low memory, silently corrupting the page tables. The same search also picked the top-of- address-space region that crashed memmap_init_zone_device() with amdkfd on Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 (\u0022LoongArch/mm: align vmemmap to maximal folio size\u0022) keeps that region in bounds on current Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g. the Loongson-2K series) are still affected.  Define DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range, (1ULL \u003C\u003C (cpu_pabits \u002B 1)) - 1, capped at (1ULL \u003C\u003C MAX_PHYSMEM_BITS) - 1 under CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d (\u0022riscv: mm: Define DIRECT_MAP_PHYSMEM_END\u0022).  [1] https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/",
  "published": "2026-09-24T16:17:19Z",
  "severity": "Moderate",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00173,
  "epssPercentile": 0.06831,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93237",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93237",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93237",
      "released": "2026-09-24T19:30:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}