Executive brief
The Linux kernel's memory management system contains a bug in how it handles the splitting of Transparent Huge Pages (THP), which can corrupt swap cache metadata. When memory pages are split, the kernel incorrectly clears internal data structures used to track swapped memory, causing system hangs and soft lockup conditions under memory pressure scenarios like page reclamation.
Technical details
This vulnerability is a data corruption issue in mm/huge_memory.c related to improper handling of page->private during THP splitting. The root cause stems from commit b653db77350c, which attempted to clear PG_private but inadvertently clobbered swp_entry_t values used by tail pages in swapcache (swp_entry_t is stored in page->private for swapcache folios). The vulnerability is triggered during memory reclamation operations (madvise, swap allocation) when the kernel attempts to access corrupted swap cache metadata, leading to soft lockup conditions. An attacker cannot directly exploit this remotely, but any user-space process performing heavy memory operations (mmap, madvise) on a system under memory pressure can trigger the condition. The fix restricts the page->private clobbering to non-swapcache pages only.
Affected products
- Linux Linux Kernel 6.0 (affecting kernel 6.0.x and potentially earlier versions patched by commit b653db77350c)
Timeline
- 2025-10-07: disclosed
- other: Regression introduced by commit b653db77350c