# CVE-2026-98939: linux: In the Linux kernel, the following vulnerability has been resolved:  x86/mm: Drop unnecessary PMD page copy when free...

CVE-2026-98939 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98939 (version 7.2.10-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98939
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  x86/mm: Drop unnecessary PMD page copy when freeing  On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page protection munging code.  The huge vmap code holds the same lock over a GFP_KERNEL allocation, which is a no-no now that reclaim can take it. That allocation is in a page table *free* path and ends up being for dubious purposes[1]. Basically, it tries to avoid hardware setting Accessed=1 in page table entries that are unreachable by the hardware, a non-issue.  Remove the PMD copy. Detach the original PMD page at the PUD, flush the mid-level caches, and free the PTE tables straight from the detached PMD page. With no allocation left, the locking issue is gone.  Lockdep splat/analysis:    WARNING: possible circular locking dependency detected   7.3.0-rc3-f6e7b42bf05b+ #183 Tainted: G     U   ------------------------------------------------------   kswapd0/269 is trying to acquire lock:   ((init_mm).mmap_lock){++++}-{4:4}, at: change_page_attr_set_clr+0x29a/0x4a0   but task is already holding lock:   (pool_shrink_rwsem){.+.+}-{4:4}, at: ttm_pool_shrink+0xb2/0x330 [ttm]   Chain exists of:     (init_mm).mmap_lock --> fs_reclaim --> pool_shrink_rwsem  The cycle is built from three edges:    1) pool_shrink_rwsem -> (init_mm).mmap_lock       The TTM shrinker restores the caching attribute of every page it      frees, while holding pool_shrink_rwsem:         ttm_pool_shrink()        -> ttm_pool_dispose_list()        -> ttm_pool_free_page()        -> set_pages_wb()        -> change_page_attr_set_clr()   [ init_mm mmap read lock ]    2) fs_reclaim -> pool_shrink_rwsem       The same shrinker, called from reclaim.    3) (init_mm).mmap_lock -> fs_reclaim       ioremap() installing a huge PUD mapping over an existing PMD table:         ioremap_page_range()        -> vmap_range_noflush()        -> vmap_try_huge_pud()          [ init_mm mmap read lock ]        -> pud_free_pmd_page()        -> __get_free_page(GFP_KERNEL)  [ enters reclaim ]  [ dhansen: Lots of changelog munging/trimming and merged comments from my 	   version of the fix. ]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98939](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98939.md) | Oct 24, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.