HIGH Introduced in 2.6.27
sgi-gru TLBMiss Race
CVE-2026-90383
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user page tables and supports only PMD-level large mappings on x86-64. Remove the direct walker. Send interrupt faults directly to user polling mode so the existing call-OS fallback retries them in process context. Remove the mmap-lock failure statistic that can no longer be incremented.
02KernelScan AI Analysis
Risk summary
A local user on a system with SGI GRU hardware can race concurrent page table modifications against the GRU interrupt handler's unlocked page table walk, potentially causing use-after-free on page table pages. This could lead to kernel memory corruption, information disclosure, or a system crash. The vulnerability is limited to systems with CONFIG_SGI_GRU enabled (SGI UV platforms).
Vulnerability analysis
The GRU hardware's TLB miss handler walks process page tables directly from interrupt context without acquiring locks or holding references on the pages being mapped. This creates a race where another CPU can free or modify those page tables while the walk is in progress, leading to use-after-free on page table structures. The fix removes this interrupt-context walker entirely and sends all interrupt faults to user polling mode, so the existing fallback retries them in process context with proper locking. This vulnerability is only reachable on systems with SGI GRU hardware by a local user with access to the GRU device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.27 | 6.12.110 | 877423f595b6 |
| 6.18 | 2.6.27 | 6.18.52 | 6248eb1833ff |
| 6.6 | 2.6.27 | 6.6.160 | 5a540ced720b |
| 7.2 | 2.6.27 | 7.2.6 | ef81e4a1628e |
| mainline | 2.6.27 | 7.3 | 928a8e9f523d |
| cip/6.12 | 2.6.27 | 6.12.111-cip32 | 877423f595b6 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |