CVE-2026-72175 (GCVE-0-2026-72175)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up to v5 [1]. Per review feedback that fixes should not sit in the middle of a feature series, they are split out and sent on their own; the RWP series is reposted rebased on top of this. All six were flagged by the Sashiko AI review of the RWP series and carry independent of RWP, apply to mm-new directly, and carry Cc: stable@. 1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates when PAGEMAP_SCAN write-protects a hugetlb PTE. 2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range against HPAGE_SIZE rather than the hstate page size, so it never write-protects gigantic hugetlb pages. 3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole() calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb vma lock for read, and hugetlb_change_protection() then takes it for write. Install the marker inline instead. 4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp on a device-private PMD permission downgrade, silently losing the uffd-wp marker. 5: userfaultfd: must_wait() applies pte_write() to a locklessly read PTE without checking pte_present(), so swap/migration entries decode random offset bits and a thread can stay parked on a stale fault. 6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to mk_vma_flags() unconditionally, an out-of-bounds write into the single-word vma_flags_t on 32-bit. Build the mask from config-gated per-mode masks so an unavailable bit is never materialised. This patch (of 6): make_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by calling huge_ptep_modify_prot_commit() with a ptent snapshot that was fetched without the corresponding huge_ptep_modify_prot_start(). The start helper is what atomically clears the entry so the kernel-owned snapshot stays consistent until the commit; without it, the hardware may set Dirty or Accessed in the live PTE between the original read and the commit, and huge_ptep_modify_prot_commit() (whose generic implementation just calls set_huge_pte_at()) then writes the stale snapshot back over the live hardware bits, losing the update. The non-hugetlb sibling make_uffd_wp_pte() does this correctly via ptep_modify_prot_start() / ptep_modify_prot_commit(). Mirror that pattern for the present-PTE branch. The migration case stays as-is -- migration entries are non-present, so there's no hardware update to race against.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 50a25249a6355db74c2c1b6be541b4caab9f3655 (git)
Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 8e39ed92d7c5c6bfc08dc45153916f49a4e98bab (git)
Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 6b7f774b8882445d9174681747d37c42548686a4 (git)
Affected: 52526ca7fdb905a768a93f8faa418e9b988fc34b , < 04718f7c9290f95385f0dd328758753dc1c36dec (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50a25249a6355db74c2c1b6be541b4caab9f3655",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "8e39ed92d7c5c6bfc08dc45153916f49a4e98bab",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "6b7f774b8882445d9174681747d37c42548686a4",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "04718f7c9290f95385f0dd328758753dc1c36dec",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\n\nPatch series \"userfaultfd/pagemap: pre-existing fixes\".\n\nThese are pre-existing bug fixes that were carried at the front of the\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\nfeedback that fixes should not sit in the middle of a feature series, they\nare split out and sent on their own; the RWP series is reposted rebased on\ntop of this.\n\nAll six were flagged by the Sashiko AI review of the RWP series and carry\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\n\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\n\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\n     against HPAGE_SIZE rather than the hstate page size, so it never\n     write-protects gigantic hugetlb pages.\n\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\n     vma lock for read, and hugetlb_change_protection() then takes it\n     for write. Install the marker inline instead.\n\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\n     on a device-private PMD permission downgrade, silently losing the\n     uffd-wp marker.\n\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\n     PTE without checking pte_present(), so swap/migration entries\n     decode random offset bits and a thread can stay parked on a stale\n     fault.\n\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\n     per-mode masks so an unavailable bit is never materialised.\n\n\nThis patch (of 6):\n\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\nfetched without the corresponding huge_ptep_modify_prot_start().  The\nstart helper is what atomically clears the entry so the kernel-owned\nsnapshot stays consistent until the commit; without it, the hardware may\nset Dirty or Accessed in the live PTE between the original read and the\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\nlive hardware bits, losing the update.\n\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\nfor the present-PTE branch.  The migration case stays as-is -- migration\nentries are non-present, so there\u0027s no hardware update to race against."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the PAGEMAP_SCAN ioctl on /proc/\u003cpid\u003e/pagemap, which requires local access to a process address space and cannot be triggered remotely.\nAC:L - The attacker controls both sides of the race by issuing PAGEMAP_SCAN with PM_SCAN_WP_MATCHING while concurrently writing the same present HugeTLB page from another thread in the target process.\nPR:L - Any unprivileged local user can open /proc/self/pagemap and trigger the ioctl; ptrace read checks also allow same-UID access to another process\u0027s pagemap without real root privileges.\nUI:N - No victim user action is required; exploitation is performed entirely by the attacker ioctl-ing pagemap and racing writes against their own or same-UID process mappings.\nS:U - The vulnerability corrupts PTE metadata within the target mm only and does not cross VM, container, or kernel/user security boundaries.\nC:H - Stale HugeTLB PTE commits can clear hardware Dirty/Accessed bits; this PTE corruption can expose stale file-backed data to other mappers or userfaultfd migration consumers instead of current memory contents.\nI:H - Lost Dirty bits break folio dirty tracking and writeback for HugeTLB mappings, allowing silent loss or corruption of in-memory modifications that should have been persisted or migrated.\nA:N - The race corrupts PTE metadata without causing kernel oops, panic, or hang; availability impact is limited to incorrect page state rather than system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:11.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec"
        }
      ],
      "title": "fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72175",
    "datePublished": "2026-08-15T05:53:40.011Z",
    "dateReserved": "2026-08-09T03:40:39.910Z",
    "dateUpdated": "2026-08-17T05:41:11.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72175",
      "date": "2026-08-24",
      "epss": "0.00172",
      "percentile": "0.06604"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72175\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:35.677\",\"lastModified\":\"2026-08-17T06:18:17.987\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\\n\\nPatch series \\\"userfaultfd/pagemap: pre-existing fixes\\\".\\n\\nThese are pre-existing bug fixes that were carried at the front of the\\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\\nfeedback that fixes should not sit in the middle of a feature series, they\\nare split out and sent on their own; the RWP series is reposted rebased on\\ntop of this.\\n\\nAll six were flagged by the Sashiko AI review of the RWP series and carry\\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\\n\\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\\n\\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\\n     against HPAGE_SIZE rather than the hstate page size, so it never\\n     write-protects gigantic hugetlb pages.\\n\\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\\n     vma lock for read, and hugetlb_change_protection() then takes it\\n     for write. Install the marker inline instead.\\n\\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\\n     on a device-private PMD permission downgrade, silently losing the\\n     uffd-wp marker.\\n\\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\\n     PTE without checking pte_present(), so swap/migration entries\\n     decode random offset bits and a thread can stay parked on a stale\\n     fault.\\n\\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\\n     per-mode masks so an unavailable bit is never materialised.\\n\\n\\nThis patch (of 6):\\n\\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\\nfetched without the corresponding huge_ptep_modify_prot_start().  The\\nstart helper is what atomically clears the entry so the kernel-owned\\nsnapshot stays consistent until the commit; without it, the hardware may\\nset Dirty or Accessed in the live PTE between the original read and the\\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\\nlive hardware bits, losing the update.\\n\\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\\nfor the present-PTE branch.  The migration case stays as-is -- migration\\nentries are non-present, so there\u0027s no hardware update to race against.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/proc/task_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"50a25249a6355db74c2c1b6be541b4caab9f3655\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"8e39ed92d7c5c6bfc08dc45153916f49a4e98bab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"6b7f774b8882445d9174681747d37c42548686a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"52526ca7fdb905a768a93f8faa418e9b988fc34b\",\"lessThan\":\"04718f7c9290f95385f0dd328758753dc1c36dec\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/proc/task_mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:20:08+00:00",
      "cve": "CVE-2026-72175",
      "id": "CVE-2026-72175",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72175.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.