{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98939 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98939 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98939 and fix it if it is affected.\n\nWhat it is: CVE-2026-98939 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98939 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98939/ (Markdown: https://insights.sbomify.com/CVE-2026-98939/index.md)","id":"CVE-2026-98939","markdown":"https://insights.sbomify.com/CVE-2026-98939/index.md","name":"CVE-2026-98939","record":{"aliases":["BELL-CVE-2026-98939","DEBIAN-CVE-2026-98939","GHSA-6vp7-hj7x-73jj","UBUNTU-CVE-2026-98939"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Drop unnecessary PMD page copy when freeing\n\nOn a box with a discrete GPU, lockdep reports a possible deadlock as\nsoon as kswapd shrinks the TTM page pool. The immediate cause is an\nx86 commit that added an mmap_read_lock() to kernel page protection\nmunging code.\n\nThe huge vmap code holds the same lock over a GFP_KERNEL allocation,\nwhich is a no-no now that reclaim can take it. That allocation is in a\npage table *free* path and ends up being for dubious purposes[1].\nBasically, it tries to avoid hardware setting Accessed=1 in page table\nentries that are unreachable by the hardware, a non-issue.\n\nRemove the PMD copy. Detach the original PMD page at the PUD, flush\nthe mid-level caches, and free the PTE tables straight from the\ndetached PMD page. With no allocation left, the locking issue is gone.\n\nLockdep splat/analysis:\n\n  WARNING: possible circular locking dependency detected\n  7.3.0-rc3-f6e7b42bf05b+ #183 Tainted: G     U\n  ------------------------------------------------------\n  kswapd0/269 is trying to acquire lock:\n  ((init_mm).mmap_lock){++++}-{4:4}, at: change_page_attr_set_clr+0x29a/0x4a0\n  but task is already holding lock:\n  (pool_shrink_rwsem){.+.+}-{4:4}, at: ttm_pool_shrink+0xb2/0x330 [ttm]\n  Chain exists of:\n    (init_mm).mmap_lock --\u003e fs_reclaim --\u003e pool_shrink_rwsem\n\nThe cycle is built from three edges:\n\n  1) pool_shrink_rwsem -\u003e (init_mm).mmap_lock\n\n     The TTM shrinker restores the caching attribute of every page it\n     frees, while holding pool_shrink_rwsem:\n\n       ttm_pool_shrink()\n       -\u003e ttm_pool_dispose_list()\n       -\u003e ttm_pool_free_page()\n       -\u003e set_pages_wb()\n       -\u003e change_page_attr_set_clr()   [ init_mm mmap read lock ]\n\n  2) fs_reclaim -\u003e pool_shrink_rwsem\n\n     The same shrinker, called from reclaim.\n\n  3) (init_mm).mmap_lock -\u003e fs_reclaim\n\n     ioremap() installing a huge PUD mapping over an existing PMD table:\n\n       ioremap_page_range()\n       -\u003e vmap_range_noflush()\n       -\u003e vmap_try_huge_pud()          [ init_mm mmap read lock ]\n       -\u003e pud_free_pmd_page()\n       -\u003e __get_free_page(GFP_KERNEL)  [ enters reclaim ]\n\n[ dhansen: Lots of changelog munging/trimming and merged comments from my\n\t   version of the fix. ]","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"x86/mm: Drop unnecessary PMD page copy when freeing","id":"CVE-2026-98939","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"ASoC: qcom: lpass-cpu: use DAI table index for playback constraints","id":"CVE-2026-98940"},"packages":[],"prev":{"headline":"rust: irq: pass RegistrationInner as cookie to request_irq","id":"CVE-2026-98938"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98939/"}