7.8

CVE-2026-90383: linux

CVSS: 7.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-90383DEBIAN-CVE-2026-90383
Published 17-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-90383 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11893-1

Timeline

  1. 17-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user page tables and supports only PMD-level large mappings on x86-64. Remove the direct walker. Send interrupt faults directly to user polling mode so the existing call-OS fallback retries them in process context. Remove the mmap-lock failure statistic that can no longer be incremented.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 142586409c8be7dc071bb94d7cd2d69ccfd99b6b, < 5a540ced720b4397306337cab34af1af4b30827c | ≥ 142586409c8be7dc071bb94d7cd2d69ccfd99b6b, < 877423f595b60f8fe7c18b64a5d283d9e1732a13 | ≥ 142586409c8be7dc071bb94d7cd2d69ccfd99b6b, < 6248eb1833ff0adfdbbadd5f846c2f22e02a01b0 | ≥ 142586409c8be7dc071bb94d7cd2d69ccfd99b6b, < ef81e4a1628ecfb9cfc442de10883f383faf17a1 | ≥ 142586409c8be7dc071bb94d7cd2d69ccfd99b6b, < 928a8e9f523df845fc496bcb9811013b67aabec5 | 2.6.27

3 vendors · 172 products

References

9 links