Junglewise Threat Intelligence

CVE-2026-23100: Linux Kernel HugeTLB incorrect shared PMD table detection

CVE-2026-23100 · Severity: medium · CVSS 5.5 · Published 2026-02-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash or performance degradation. The issue stems from how the system tracks shared memory tables, which can lead to incorrect memory accounting and improper handling of memory migration. This affects systems using large memory pages (HugeTLB), potentially impacting service availability and operational stability.

Technical details

A logic error in the Linux kernel's HugeTLB subsystem occurred because hugetlb_pmd_shared() was not updated to use the new independent shared count mechanism (ptdesc->pt_share_count). Previously, the function relied on page refcounts, which no longer reflect sharing status after recent architectural changes. This failure to detect shared PMD tables causes the kernel to incorrectly treat shared folios as private, leading to improper behavior during page migration (e.g., mbind or migrate_pages) and incorrect reporting in smaps and pagemap interfaces. An attacker with local access could potentially exploit this to cause a denial-of-service or trigger unexpected kernel behavior. The issue has been resolved by updating the function to use ptdesc_pmd_is_shared().

Affected products

  • Linux Linux Kernel versions prior to 6.13.y, 6.12.y, 6.6.y, 6.1.y, 5.15.y, 5.10.y, 5.4.y, 4.19.y
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-12-23: disclosed: Initial patch submission by David Hildenbrand
  • 2026-02-04: advisory: CVE published
  • 2026-02-19: patched: Patch committed to stable trees

References

Related threats