mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

{
  "id": "726478daca99931981a9c4a8e0340b69a9d7113c5f0e6f7a0bfb4fb597ad8777",
  "url": "https://osv.dev/vulnerability/CVE-2026-31648",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as \"Bad page state\": \" [ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount \" After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears: \" [ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):\"stress-ng-mmaptorture-9397-0-2736200540\" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page",
    "evidence": "osv:CVE-2026-31648",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.135",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.82",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.23",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.13",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-31648",
      "aliases": [
        "CVE-2026-31648"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "fe601b70eac6cd266e8d7d55030e90a73ed0e339"
                },
                {
                  "fixed": "88591194df736a508dd5461ab2167a61e98caac1"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "743a2753a02e805347969f6f89f38b736850d808"
                },
                {
                  "fixed": "633ab680c405ac390e6bec5b74aaf46197c837b6"
                },
                {
                  "fixed": "576543bedd616254032d4ebe54a90076f9e31740"
                },
                {
                  "fixed": "9316a820b9aae07d44469d6485376dad824c5b3f"
                },
                {
                  "fixed": "f58df566524ebcdfa394329c64f47e3c9257516e"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.6.117"
                },
                {
                  "fixed": "6.6.135"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.1.159"
                },
                {
                  "fixed": "6.2"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "84ede15f27c06b111d1398dfa80b6fac4b135e34"
                }
              ]
            }
          ],
          "versions": [
            "v6.6.134",
            "v6.6.133",
            "v6.6.132",
            "v6.6.131",
            "v6.6.130",
            "v6.6.129",
            "v6.6.128",
            "v6.6.127",
            "v6.6.126",
            "v6.6.125",
            "v6.6.124",
            "v6.6.123",
            "v6.6.122",
            "v6.6.121",
            "v6.6.120",
            "v6.6.119",
            "v6.6.118",
            "v6.6.117",
            "v6.1.190",
            "v6.1.189",
            "v6.1.188",
            "v6.1.187",
            "v6.1.186",
            "v6.1.185",
            "v6.1.184",
            "v6.1.183",
            "v6.1.182",
            "v6.1.181",
            "v6.1.180",
            "v6.1.179",
            "v6.1.178",
            "v6.1.177",
            "v6.1.176",
            "v6.1.175",
            "v6.1.174",
            "v6.1.173",
            "v6.1.172",
            "v6.1.171",
            "v6.1.170",
            "v6.1.169",
            "v6.1.168",
            "v6.1.167",
            "v6.1.166",
            "v6.1.165",
            "v6.1.164",
            "v6.1.163",
            "v6.1.162",
            "v6.1.161",
            "v6.1.160",
            "v6.1.159"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31648.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.6.135"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.82"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.12.0"
                },
                {
                  "fixed": "6.18.23"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.19.13"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31648.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:31.308140574Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/576543bedd616254032d4ebe54a90076f9e31740",
        "https://git.kernel.org/stable/c/633ab680c405ac390e6bec5b74aaf46197c837b6",
        "https://git.kernel.org/stable/c/88591194df736a508dd5461ab2167a61e98caac1",
        "https://git.kernel.org/stable/c/9316a820b9aae07d44469d6485376dad824c5b3f",
        "https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31648.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-31648",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31648.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-31648",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 498330,
  "published_at": "2026-04-24T14:45:01.728+00:00"
}