Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to crash the system or potentially access data they shouldn't. The issue occurs when the system tries to reclaim memory from certain types of large memory blocks, incorrectly marking them as writable when they should be restricted. This can lead to a system failure (kernel crash) or a breach of memory security boundaries between different running programs.
Technical details
A vulnerability exists in the Linux kernel's reverse mapping (rmap) mechanism during the restoration of Page Table Entries (PTEs) for 'lazyfree' folios. When the kernel batches the unmapping of anonymous lazyfree folios via 'folio_unmap_pte_batch', it fails to correctly distinguish between writable and non-writable bits within a batch. This logic error can result in an entire batch of PTEs being incorrectly set as writable. An attacker can exploit this by manipulating Virtual Memory Areas (VMAs) using 'madvise' (MADV_DONTFORK/MADV_FREE) to trigger a state where a writable page is mapped into the page tables of multiple processes. This violates Copy-on-Write (CoW) semantics and triggers a kernel BUG_ON in 'page_table_check.c', leading to a Denial of Service (system crash) or potential privilege escalation. Patches have been released for various stable branches including 6.19.10 and 6.18.20.
Affected products
- Linux Linux Kernel 6.15 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-03: other: Initial patch submitted by Dev Jain
- 2026-04-03: advisory: CVE-2026-31398 published