Skip to content
Heist/ feed
Unrated

powerpc/64s: Fix unmap race with PMD migration entries

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full(). This patch fixes that. Thread A: move_pages() syscall add_folio_for_migration() mmap_read_lock(mm) folio_isolate_lru(folio) mmap_read_unlock(mm) do_move_pages_to_node() migrate_pages() try_to_migrate_one() spin_lock(ptl) set_pmd_migration_entry() pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn set_pmd_at() # PMD: migration swap entry (pmd_present=0) spin_unlock(ptl) [page copy phase] # <--- RACE WINDOW --> Thread B: munmap() mmap_write_downgrade(mm) unmap_vmas() -> zap_pmd_range() zap_huge_pmd() __pmd_trans_huge_lock() pmd_is_huge(): # !pmd_present && !pmd_none -> TRUE (swap entry) pmd_lock() -> # spin_lock(ptl), waits for Thread A to release ptl pmdp_huge_get_and_clear_full() VM_BUG_ON(!pmd_present(*pmdp)) # HITS! [ 287.738700][ T1867] ------------[ cut here ]------------ [ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187! cpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0] pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c lr: c000000000645dec: z

Announced Source revision 1
Original source ↗

CVE-2026-53108

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-53108

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
        "lessThan": "6f571bf37da84ab822bf22341d48655312aaee20",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
        "lessThan": "5c8dd49f4a857aa40c4a8694930509d159feae24",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
        "lessThan": "09207dc57ab4cb8967e6cad55a37e15ff8523d41",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
        "lessThan": "829367e55012c053738ebe7db20c4a90d6609ece",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
        "lessThan": "bbcbf045d6c778e82b47a35fc8728387708e9a3d",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/powerpc/include/asm/book3s/64/pgtable.h",
      "arch/powerpc/mm/book3s64/pgtable.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.8",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.114",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.57",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.10",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/powerpc/include/asm/book3s/64/pgtable.h",
      "arch/powerpc/mm/book3s64/pgtable.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-53108

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#46364 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement