CVE-2026-74632 (GCVE-0-2026-74632)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:39
VLAI
Title
mm/huge_memory: fix huge_zero_pfn race
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there. This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio. This can result in the huge zero folio being split and otherwise treated incorrectly. The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully. The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own. The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one. This patch (of 2): If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted by huge_zero_refcount and returned by mm_get_huge_zero_folio(). When the caller is done with the huge zero page, its reference count is decremented. Only a shrinker can set the reference count to zero. A race can unfortunately occur between a shrinker decrementing the reference count to zero and a concurrent page fault. This is because shrink_huge_zero_folio_scan() might, if very unlucky, be preempted between setting huge_zero_refcount to zero and writing an invalid value. During this time get_huge_zero_folio() could write to huge_zero_pfn before shrink_huge_zero_folio_scan() resumes. In this event the huge zero folio will be persistently misidentified causing the THP code path to be entered inappropriately for the huge zero folio: CPU 0 CPU 1 =======================================|================================= shrink_huge_zero_folio_scan() | atomic_cmpxchg() sets refcount to 0 | xchg() sets huge_zero_folio to NULL | get_huge_zero_folio() | | atomic_inc_not_zero() -> zero preempted for a long time | Allocate new huge zero folio | | Write valid huge_zero_folio v | Write valid huge_zero_pfn Overwrite huge_zero_pfn with ~0UL <--- Invalid overwrite! This results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly returning false for a huge zero page which could result in issues like the huge zero folio being incorrectly split. Note that the issue is with huge_zero_pfn not huge_zero_folio, as get_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL with a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set huge_zero_folio. Fix the issue by introducing a spinlock, huge_zero_lock, to prevent concurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount. There needs to be significant care taken here to ensure correctness: The fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which is outside of the critical section, and means huge zero allocation is gated on zero huge_zero_refcount. The fast path doesn't use huge_zero_lock, so the critical section is irrelevant to it. So invariants are required - huge_zero_refcount MUST: * Only be set in the huge_zero_lock critical section to ensure serialisation of huge_zero_pfn, huge_zero_folio and ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6527d8ef68c3ca3c455e38ae2a37cd7810caec73 , < 9c0fd1802ce06d7709f0bae4edeb085288f28764 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < b7041ba61c5da4e0b56f9be58cfb87d7689724e4 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < 9332b080ad57650d1dc582e54517f9fc78ef89cc (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < f3a874a903053c53fb53ba287ea9eacda69c68e8 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < 6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < 105d04edbec83010df5728f74d17fd9c108e7553 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < ab7e4b407c7f58d1a003134eff3841f303d5ccc2 (git)
Affected: 3b77e8c8cde581dadab9a0f1543a347e24315f11 , < 33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb (git)
Affected: fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8 (git)
Affected: bd092a0f19423d7e9e81182314a96ecd6a14f3b7 (git)
Affected: b1daf8f862136894a4595770a44e4508808fb806 (git)
Affected: 5.10.47 , < 5.10.267 (semver)
Affected: 4.19.197 , < 4.20 (semver)
Affected: 5.4.129 , < 5.5 (semver)
Affected: 5.12.14 , < 5.13 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.10.267 , ≤ 5.10.* (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c0fd1802ce06d7709f0bae4edeb085288f28764",
              "status": "affected",
              "version": "6527d8ef68c3ca3c455e38ae2a37cd7810caec73",
              "versionType": "git"
            },
            {
              "lessThan": "b7041ba61c5da4e0b56f9be58cfb87d7689724e4",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "9332b080ad57650d1dc582e54517f9fc78ef89cc",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "f3a874a903053c53fb53ba287ea9eacda69c68e8",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "105d04edbec83010df5728f74d17fd9c108e7553",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "ab7e4b407c7f58d1a003134eff3841f303d5ccc2",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "lessThan": "33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb",
              "status": "affected",
              "version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd092a0f19423d7e9e81182314a96ecd6a14f3b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1daf8f862136894a4595770a44e4508808fb806",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.267",
              "status": "affected",
              "version": "5.10.47",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.197",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.129",
              "versionType": "semver"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "5.10.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.197",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.129",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix huge_zero_pfn race\n\nPatch series \"mm/huge_memory: fix huge_zero_pfn race\", v2.\n\nThere is a subtle race in the reference-counted huge_zero_folio\nimplementation.\n\nThe fast path atomic logic fails to account for the fact that the shrinker\n(which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn\nwith the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a\nracing get_huge_zero_folio() installed a valid value there.\n\nThis results in huge_zero_folio being correctly set but huge_zero_pfn\nbeing set incorrectly and thus is_huge_zero_pfn() and consequently\nis_huge_zero_pmd() will misidentify the huge zero folio as being an\nordinary THP folio.\n\nThis can result in the huge zero folio being split and otherwise treated\nincorrectly.\n\nThe solution to this is very subtle as there is an atomic fast path, and\nthus ordering in weakly ordered architectures has to be treated very\ncarefully.\n\nThe first commit fixes the issue by introducing a spinlock around\nhuge_zero_[pfn, folio, refcount] write, with careful consideration paid to\nload/store ordering in the fast path.  It is placed first and kept as\nsmall as possible so that it can be backported on its own.\n\nThe second commit is a pure cleanup which reworks the\nCONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent\nlogic from the dynamically allocated one.\n\n\nThis patch (of 2):\n\nIf !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted\nby huge_zero_refcount and returned by mm_get_huge_zero_folio().\n\nWhen the caller is done with the huge zero page, its reference count is\ndecremented.  Only a shrinker can set the reference count to zero.\n\nA race can unfortunately occur between a shrinker decrementing the\nreference count to zero and a concurrent page fault.\n\nThis is because shrink_huge_zero_folio_scan() might, if very unlucky, be\npreempted between setting huge_zero_refcount to zero and writing an\ninvalid value.\n\nDuring this time get_huge_zero_folio() could write to huge_zero_pfn before\nshrink_huge_zero_folio_scan() resumes.\n\nIn this event the huge zero folio will be persistently misidentified\ncausing the THP code path to be entered inappropriately for the huge zero\nfolio:\n\n                CPU 0                                   CPU 1\n=======================================|=================================\nshrink_huge_zero_folio_scan()          |\n   atomic_cmpxchg() sets refcount to 0 |\n   xchg() sets huge_zero_folio to NULL | get_huge_zero_folio()\n                 |                     |    atomic_inc_not_zero() -\u003e zero\n      preempted for a long time        |    Allocate new huge zero folio\n                 |                     |    Write valid huge_zero_folio\n                 v                     |    Write valid huge_zero_pfn\n  Overwrite huge_zero_pfn with ~0UL   \u003c--- Invalid overwrite!\n\nThis results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly\nreturning false for a huge zero page which could result in issues like the\nhuge zero folio being incorrectly split.\n\nNote that the issue is with huge_zero_pfn not huge_zero_folio, as\nget_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL\nwith a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set\nhuge_zero_folio.\n\nFix the issue by introducing a spinlock, huge_zero_lock, to prevent\nconcurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount.\n\nThere needs to be significant care taken here to ensure correctness:\n\nThe fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which\nis outside of the critical section, and means huge zero allocation is\ngated on zero huge_zero_refcount.\n\nThe fast path doesn\u0027t use huge_zero_lock, so the critical section is\nirrelevant to it.\n\nSo invariants are required - huge_zero_refcount MUST:\n\n* Only be set in the huge_zero_lock critical section to ensure\n  serialisation of huge_zero_pfn, huge_zero_folio and\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only through local page faults in handle_mm_fault()-\u003ecreate_huge_pmd()-\u003edo_huge_pmd_anonymous_page()-\u003emm_get_huge_zero_folio() racing shrink_huge_zero_folio_scan(); no network, adjacent, or physical path exists.\nAC:L - Attacker controls both race sides: concurrent anonymous read faults drive get_huge_zero_folio() while memory-pressure reclaim drives shrink_huge_zero_folio_scan(); multi-threaded hammering makes the preemption window reliably winnable.\nPR:L - Any unprivileged local process can mmap anonymous memory and trigger huge-zero PMD installation on typical CONFIG_TRANSPARENT_HUGEPAGE systems with zero-page enabled; no root, capabilities, or authentication is required.\nUI:N - Exploitation is fully attacker-driven via standard syscalls (mmap, madvise, read, munmap) and deliberate memory pressure; no separate victim action beyond the attacker running their own workload is needed.\nS:U - Corrupts kernel-global huge_zero_folio metadata and rmap/RSS accounting within the kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox break.\nC:H - Misidentification routes the shared huge zero folio through normal THP split/teardown (folio_remove_rmap_pmd, incorrect accounting), corrupting global page metadata with plausible arbitrary kernel memory disclosure leverage.\nI:H - Wrong-path splitting manipulates refcount/rmap state on the system-wide huge zero singleton folio, corrupting kernel integrity and enabling memory-write/control-flow primitives from metadata corruption.\nA:H - Mis-split triggers kernel WARN/BUG_ON, bad page state, and bad rss-counter failures during reclaim or teardown, causing kernel oops, panic, or hang on affected THP systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:50.791Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c0fd1802ce06d7709f0bae4edeb085288f28764"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7041ba61c5da4e0b56f9be58cfb87d7689724e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9332b080ad57650d1dc582e54517f9fc78ef89cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3a874a903053c53fb53ba287ea9eacda69c68e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/105d04edbec83010df5728f74d17fd9c108e7553"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab7e4b407c7f58d1a003134eff3841f303d5ccc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb"
        }
      ],
      "title": "mm/huge_memory: fix huge_zero_pfn race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74632",
    "datePublished": "2026-08-22T15:32:13.078Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-27T12:39:50.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74632",
      "date": "2026-08-29",
      "epss": "0.00129",
      "percentile": "0.02877"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:47:56.000Z",
      "cve": "CVE-2026-74632",
      "id": "msrc_CVE-2026-74632",
      "initial_release_date": "2026-08-24T01:04:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/huge_memory: fix huge_zero_pfn race",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74632.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74632\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:36.217\",\"lastModified\":\"2026-08-27T13:18:35.130\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/huge_memory: fix huge_zero_pfn race\\n\\nPatch series \\\"mm/huge_memory: fix huge_zero_pfn race\\\", v2.\\n\\nThere is a subtle race in the reference-counted huge_zero_folio\\nimplementation.\\n\\nThe fast path atomic logic fails to account for the fact that the shrinker\\n(which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn\\nwith the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a\\nracing get_huge_zero_folio() installed a valid value there.\\n\\nThis results in huge_zero_folio being correctly set but huge_zero_pfn\\nbeing set incorrectly and thus is_huge_zero_pfn() and consequently\\nis_huge_zero_pmd() will misidentify the huge zero folio as being an\\nordinary THP folio.\\n\\nThis can result in the huge zero folio being split and otherwise treated\\nincorrectly.\\n\\nThe solution to this is very subtle as there is an atomic fast path, and\\nthus ordering in weakly ordered architectures has to be treated very\\ncarefully.\\n\\nThe first commit fixes the issue by introducing a spinlock around\\nhuge_zero_[pfn, folio, refcount] write, with careful consideration paid to\\nload/store ordering in the fast path.  It is placed first and kept as\\nsmall as possible so that it can be backported on its own.\\n\\nThe second commit is a pure cleanup which reworks the\\nCONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent\\nlogic from the dynamically allocated one.\\n\\n\\nThis patch (of 2):\\n\\nIf !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted\\nby huge_zero_refcount and returned by mm_get_huge_zero_folio().\\n\\nWhen the caller is done with the huge zero page, its reference count is\\ndecremented.  Only a shrinker can set the reference count to zero.\\n\\nA race can unfortunately occur between a shrinker decrementing the\\nreference count to zero and a concurrent page fault.\\n\\nThis is because shrink_huge_zero_folio_scan() might, if very unlucky, be\\npreempted between setting huge_zero_refcount to zero and writing an\\ninvalid value.\\n\\nDuring this time get_huge_zero_folio() could write to huge_zero_pfn before\\nshrink_huge_zero_folio_scan() resumes.\\n\\nIn this event the huge zero folio will be persistently misidentified\\ncausing the THP code path to be entered inappropriately for the huge zero\\nfolio:\\n\\n                CPU 0                                   CPU 1\\n=======================================|=================================\\nshrink_huge_zero_folio_scan()          |\\n   atomic_cmpxchg() sets refcount to 0 |\\n   xchg() sets huge_zero_folio to NULL | get_huge_zero_folio()\\n                 |                     |    atomic_inc_not_zero() -\u003e zero\\n      preempted for a long time        |    Allocate new huge zero folio\\n                 |                     |    Write valid huge_zero_folio\\n                 v                     |    Write valid huge_zero_pfn\\n  Overwrite huge_zero_pfn with ~0UL   \u003c--- Invalid overwrite!\\n\\nThis results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly\\nreturning false for a huge zero page which could result in issues like the\\nhuge zero folio being incorrectly split.\\n\\nNote that the issue is with huge_zero_pfn not huge_zero_folio, as\\nget_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL\\nwith a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set\\nhuge_zero_folio.\\n\\nFix the issue by introducing a spinlock, huge_zero_lock, to prevent\\nconcurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount.\\n\\nThere needs to be significant care taken here to ensure correctness:\\n\\nThe fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which\\nis outside of the critical section, and means huge zero allocation is\\ngated on zero huge_zero_refcount.\\n\\nThe fast path doesn\u0027t use huge_zero_lock, so the critical section is\\nirrelevant to it.\\n\\nSo invariants are required - huge_zero_refcount MUST:\\n\\n* Only be set in the huge_zero_lock critical section to ensure\\n  serialisation of huge_zero_pfn, huge_zero_folio and\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/huge_memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6527d8ef68c3ca3c455e38ae2a37cd7810caec73\",\"lessThan\":\"9c0fd1802ce06d7709f0bae4edeb085288f28764\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"b7041ba61c5da4e0b56f9be58cfb87d7689724e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"9332b080ad57650d1dc582e54517f9fc78ef89cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"f3a874a903053c53fb53ba287ea9eacda69c68e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"105d04edbec83010df5728f74d17fd9c108e7553\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"ab7e4b407c7f58d1a003134eff3841f303d5ccc2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b77e8c8cde581dadab9a0f1543a347e24315f11\",\"lessThan\":\"33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd092a0f19423d7e9e81182314a96ecd6a14f3b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b1daf8f862136894a4595770a44e4508808fb806\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.47\",\"lessThan\":\"5.10.267\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.197\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.129\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.12.14\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/huge_memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.267\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/105d04edbec83010df5728f74d17fd9c108e7553\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9332b080ad57650d1dc582e54517f9fc78ef89cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c0fd1802ce06d7709f0bae4edeb085288f28764\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab7e4b407c7f58d1a003134eff3841f303d5ccc2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7041ba61c5da4e0b56f9be58cfb87d7689724e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3a874a903053c53fb53ba287ea9eacda69c68e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:52:27+00:00",
      "cve": "CVE-2026-74632",
      "id": "CVE-2026-74632",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/huge_memory: fix huge_zero_pfn race",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74632.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.