Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash or potentially corrupt system memory. The issue occurs when the kernel incorrectly handles certain types of large memory pages during move operations. This could lead to a denial of service or unauthorized access to sensitive information by destabilizing the operating system's core memory tracking.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the mm/huge_memory.c component of the Linux kernel. Specifically, move_pages_huge_pmd() incorrectly uses a NULL sentinel for src_folio when handling UFFDIO_MOVE for huge zero pages. This NULL value is passed to folio_mk_pmd(), which leads to a NULL dereference on some memory models or the generation of a bogus Page Frame Number (PFN) pointing to non-existent physical memory on SPARSEMEM_VMEMMAP systems. Additionally, the function failed to preserve the 'special' PMD state, potentially leading to reference count corruption. The issue is resolved by deriving the destination entry from the source PMD value and properly handling PMD metadata.
Affected products
- Linux Linux Kernel 6.16 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-03: other: Patch authored
- 2026-04-03: disclosed: CVE published
- 2026-05-20: advisory: NVD analysis updated