mm/page_reporting: use system_freezable_wq to fix UAF during suspend
In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete their virtqueues via vdev->config->del_vqs(). However, page reporting work (page_reporting_process) was scheduled on the global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM freezer skips it, leaving page_reporting_process active during suspend. If pages are freed into the buddy allocator while suspending (for example, when core MM invokes the balloon shrinker during S4 hibernation image saving), page reporting triggers virtballoon_free_page_report() on deleted virtqueues, resulting in a Use-After-Free / General Protection Fault: [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI [ 196.825967] Workqueue: events page_reporting_process [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring] [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon] [ 196.946943] page_reporting_process+0x370/0x4f0 Fix this by switching page reporting work to system_freezable_wq. This ensures that the PM freezer pauses page_reporting_process before device drivers destroy their reporting virtqueues. Because the reporting worker is frozen, memory reclamation/freeing (e.g. via shrinker execution) can safely return pages to
CVE-2026-74481
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74481
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "a4c60046052777ca1dcc83fe3ece2a5136b301f1",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "b2c094e98f8bb823b3ae475f7169fe2091c40c6d",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "992f270fd808338fbae1f498a5e325e7e2e20368",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "f978048326570047e8216e81a67f9c71ef2bb1b1",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "450f35f4d5a682a0796757e52295df58ddb63bc9",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "b11907c905fa08eda925395f0724b7a409870f65",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "faf439b5fa7b231120eac4f7a617e0bfd4f6f5c7",
"versionType": "git"
},
{
"status": "affected",
"version": "36e66c554b5c6a9d17a229faca7a61693527b0bd",
"lessThan": "0b45f6927a14914ff685fe0e6f9d11232a1e03df",
"versionType": "git"
}
],
"programFiles": [
"mm/page_reporting.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"mm/page_reporting.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74481
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #33172 · Revision 1
- Added to Heist Feed
- Publisher date