powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 64K pagesize, we have 16 fragments of 4K size in one 64K page. Patch series [1] "mm: free retracted page table by RCU" added pte_free_defer() to defer the freeing of PTE tables when retract_page_tables() is called for madvise MADV_COLLAPSE on shmem range. [1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/ pte_free_defer() sets the active flag on the corresponding fragment's folio & calls pte_fragment_free(), which reduces the pt_frag_refcount. When pt_frag_refcount reaches 0 (no active fragment using the folio), it checks if the folio active flag is set, if set, it calls call_rcu to free the folio, it the active flag is unset then it calls pte_free_now(). Now, this can lead to following problem in a corner case... [ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62 [ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62 [ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff) [ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000 [ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000 [ 265.361438][ T183] page dumped becaus
CVE-2026-53109
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53109
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"lessThan": "e9d197c248e70278645f206defa87f085826c4c1",
"versionType": "git"
},
{
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"lessThan": "f4bc93135bfe39e7052d31e4c71f5f838e0bf516",
"versionType": "git"
},
{
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"lessThan": "c8b710655012a2993a9567873fb71a8a51f8459c",
"versionType": "git"
},
{
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"lessThan": "a32db6fca3c74b4eb8bae5470f0680deb4cbac6f",
"versionType": "git"
},
{
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"lessThan": "fda4d71651f71c44b35829d13f3c8bf920032f77",
"versionType": "git"
}
],
"programFiles": [
"arch/powerpc/mm/pgtable-frag.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/powerpc/mm/pgtable-frag.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53109
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46365 · Revision 1
- Added to Heist Feed
- Publisher date