mm/huge_memory: fix huge_zero_pfn race
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there. This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio. This can result in the huge zero folio being split and otherwise treated incorrectly. The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully. The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own. The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one. This patch (of 2): If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero
CVE-2026-74632
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74632
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6527d8ef68c3ca3c455e38ae2a37cd7810caec73",
"lessThan": "9c0fd1802ce06d7709f0bae4edeb085288f28764",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "b7041ba61c5da4e0b56f9be58cfb87d7689724e4",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "9332b080ad57650d1dc582e54517f9fc78ef89cc",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "f3a874a903053c53fb53ba287ea9eacda69c68e8",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "105d04edbec83010df5728f74d17fd9c108e7553",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "ab7e4b407c7f58d1a003134eff3841f303d5ccc2",
"versionType": "git"
},
{
"status": "affected",
"version": "3b77e8c8cde581dadab9a0f1543a347e24315f11",
"lessThan": "33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb",
"versionType": "git"
},
{
"status": "affected",
"version": "fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8",
"versionType": "git"
},
{
"status": "affected",
"version": "bd092a0f19423d7e9e81182314a96ecd6a14f3b7",
"versionType": "git"
},
{
"status": "affected",
"version": "b1daf8f862136894a4595770a44e4508808fb806",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.47",
"lessThan": "5.10.267",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.197",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.129",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.12.14",
"lessThan": "5.13",
"versionType": "semver"
}
],
"programFiles": [
"mm/huge_memory.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"mm/huge_memory.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74632
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34252 · Revision 1
- Added to Heist Feed
- Publisher date