Skip to content
Heist/ feed
UnratedFix available

mm/khugepaged: write all dirty file folios when collapsing

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")] As-is, khugepaged and writable-file opening exclude each other. A file cannot be open writeable and have THPs (because the filesystem is not aware of them). khugepaged will never collapse file pages for files that are opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that particular file is dropped. This is fine because nothing could've been dirtied. However, there is an edge-case: collapse_file() might not be able to coexist with concurrent writers, but it can coexist with dirty folios (from previous writers). Therefore, the following can happen: open(file, O_RDWR) write(file) close(file) madvise(file_mapping, MADV_COLLAPSE, some non-dirty range) open(file, O_RDWR) nr_thps > 0 truncate_inode_pages() /* THPs are cleared out, but so are the dirty folios */ When this edge-case happens, there is data loss, as the dirty folios are fully discarded. Fix it by fully writing back the page cache (and waiting) when collapsing file THPs. Doing so provides the guarantee that no dirty folio will be observed while there are active THPs. To fully ensure this is safe, the invalidate_lock needs to be held while doing the writeout, so that do_dentry_open()'s page cache truncation excludes this write-and-

Announced Source revision 1
Original source ↗

CVE-2026-68086

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:CVE-2026-68086

Kernel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
7.1.4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
        "type": "GIT",
        "events": [
          {
            "introduced": "99cb0dbd47a15d395bf3faa78dc122bc5efe3fc0"
          },
          {
            "fixed": "2dfe9f5c91d0963058f8a5e46e1c2a908382cc46"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68086.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "5.4.0"
          },
          {
            "fixed": "7.1.4"
          }
        ]
      }
    ],
    "package": {
      "name": "Kernel",
      "ecosystem": "Linux"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68086.json"
    }
  }
]
Related CVEs
CVE-2026-68086

Source reference: /id

Publisher severity

No explicit severity was provided.

Event
#50709 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement