powerpc/64s: Fix unmap race with PMD migration entries
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full(). This patch fixes that. Thread A: move_pages() syscall add_folio_for_migration() mmap_read_lock(mm) folio_isolate_lru(folio) mmap_read_unlock(mm) do_move_pages_to_node() migrate_pages() try_to_migrate_one() spin_lock(ptl) set_pmd_migration_entry() pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn set_pmd_at() # PMD: migration swap entry (pmd_present=0) spin_unlock(ptl) [page copy phase] # <--- RACE WINDOW --> Thread B: munmap() mmap_write_downgrade(mm) unmap_vmas() -> zap_pmd_range() zap_huge_pmd() __pmd_trans_huge_lock() pmd_is_huge(): # !pmd_present && !pmd_none -> TRUE (swap entry) pmd_lock() -> # spin_lock(ptl), waits for Thread A to release ptl pmdp_huge_get_and_clear_full() VM_BUG_ON(!pmd_present(*pmdp)) # HITS! [ 287.738700][ T1867] ------------[ cut here ]------------ [ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187! cpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0] pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c lr: c000000000645dec: z
CVE-2026-53108
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53108
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"lessThan": "6f571bf37da84ab822bf22341d48655312aaee20",
"versionType": "git"
},
{
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"lessThan": "5c8dd49f4a857aa40c4a8694930509d159feae24",
"versionType": "git"
},
{
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"lessThan": "09207dc57ab4cb8967e6cad55a37e15ff8523d41",
"versionType": "git"
},
{
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"lessThan": "829367e55012c053738ebe7db20c4a90d6609ece",
"versionType": "git"
},
{
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"lessThan": "bbcbf045d6c778e82b47a35fc8728387708e9a3d",
"versionType": "git"
}
],
"programFiles": [
"arch/powerpc/include/asm/book3s/64/pgtable.h",
"arch/powerpc/mm/book3s64/pgtable.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/powerpc/include/asm/book3s/64/pgtable.h",
"arch/powerpc/mm/book3s64/pgtable.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53108
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46364 · Revision 1
- Added to Heist Feed
- Publisher date