Skip to content
Heist/ feed
Unrated

x86/mm: Fix user-space data loss with MADV_FREE and THP

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADV_FREE and THP Some of users of Polars (a data analytics library) have lost production data from this bug. They seem to have just the right combination of huge pages, MADV_FREE and heavy reclaim pressure. pmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY), silently discarding the hardware dirty bit. The subsequent pmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into _PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already stripped from the value, so there is nothing left to transfer. Contrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask, and pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify() is the odd one out. Any pmd_modify() on a writable, dirty PMD loses the dirty state. One visible consequence is data loss with MADV_FREE on PMD-mapped THP: memset(buf, 0x5A, size); // PMD-mapped THP, PMD dirty madvise(buf, size, MADV_FREE); // PMD cleaned but left writable, // folio marked lazyfree memset(buf, 0x5A, size); // hardware sets _PAGE_DIRTY again mprotect(buf, size, PROT_READ); // pmd_modify() drops the dirty bit mprotect(buf, size, PROT_READ|PROT_WRITE); // ... memory pressure ... Reclaim (e.g. under memcg pressure) then finds the lazyfree folio with no dirty bit set anywhere and frees it in __discard_anon_folio_pmd_locked(), even though the data was rewritten after MADV_FREE; subsequent reads f

Announced Source revision 1
Original source ↗

CVE-2026-97945

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97945

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "bb3aadf7d446aaf22c725b274e2c194ac5cb2111",
        "lessThan": "b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "bb3aadf7d446aaf22c725b274e2c194ac5cb2111",
        "lessThan": "e4d569fe2f436a9b58c048fefabf56eab68c1b7e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "bb3aadf7d446aaf22c725b274e2c194ac5cb2111",
        "lessThan": "55ddbc2ca6d5db64d44c3fb8f8705b4d39eb30b7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "bb3aadf7d446aaf22c725b274e2c194ac5cb2111",
        "lessThan": "a5ad97cbcfcec31430268441c10eedde73200177",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "bb3aadf7d446aaf22c725b274e2c194ac5cb2111",
        "lessThan": "f7491d7c81db0e7c304a7bd757a76d2fbeaff80e",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/x86/include/asm/pgtable.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.6"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.6",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.111",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.53",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.7",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/x86/include/asm/pgtable.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-97945

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#38088 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement