{
  "cveId": "CVE-2026-98939",
  "url": "https://patchblox.com/security/cve/CVE-2026-98939",
  "summary": "CVE-2026-98939 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98939 (version 7.2.10-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  x86/mm: Drop unnecessary PMD page copy when free...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  x86/mm: Drop unnecessary PMD page copy when freeing  On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page protection munging code.  The huge vmap code holds the same lock over a GFP_KERNEL allocation, which is a no-no now that reclaim can take it. That allocation is in a page table *free* path and ends up being for dubious purposes[1]. Basically, it tries to avoid hardware setting Accessed=1 in page table entries that are unreachable by the hardware, a non-issue.  Remove the PMD copy. Detach the original PMD page at the PUD, flush the mid-level caches, and free the PTE tables straight from the detached PMD page. With no allocation left, the locking issue is gone.  Lockdep splat/analysis:    WARNING: possible circular locking dependency detected   7.3.0-rc3-f6e7b42bf05b\u002B #183 Tainted: G     U   ------------------------------------------------------   kswapd0/269 is trying to acquire lock:   ((init_mm).mmap_lock){\u002B\u002B\u002B\u002B}-{4:4}, at: change_page_attr_set_clr\u002B0x29a/0x4a0   but task is already holding lock:   (pool_shrink_rwsem){.\u002B.\u002B}-{4:4}, at: ttm_pool_shrink\u002B0xb2/0x330 [ttm]   Chain exists of:     (init_mm).mmap_lock --\u003E fs_reclaim --\u003E pool_shrink_rwsem  The cycle is built from three edges:    1) pool_shrink_rwsem -\u003E (init_mm).mmap_lock       The TTM shrinker restores the caching attribute of every page it      frees, while holding pool_shrink_rwsem:         ttm_pool_shrink()        -\u003E ttm_pool_dispose_list()        -\u003E ttm_pool_free_page()        -\u003E set_pages_wb()        -\u003E change_page_attr_set_clr()   [ init_mm mmap read lock ]    2) fs_reclaim -\u003E pool_shrink_rwsem       The same shrinker, called from reclaim.    3) (init_mm).mmap_lock -\u003E fs_reclaim       ioremap() installing a huge PUD mapping over an existing PMD table:         ioremap_page_range()        -\u003E vmap_range_noflush()        -\u003E vmap_try_huge_pud()          [ init_mm mmap read lock ]        -\u003E pud_free_pmd_page()        -\u003E __get_free_page(GFP_KERNEL)  [ enters reclaim ]  [ dhansen: Lots of changelog munging/trimming and merged comments from my \t   version of the fix. ]",
  "published": "2026-10-23T13:17:14Z",
  "severity": "",
  "epss": 0.00166,
  "epssPercentile": 0.05938,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98939",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98939",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}