Executive brief
A race condition in the Linux kernel's memory management system could allow a local user to trigger a system crash. The issue occurs when the system tries to read memory mapping information while certain hardware drivers (like those used for high-performance graphics or network cards) are simultaneously setting up direct memory access. This results in a 'kernel oops' or system hang, impacting the availability of the server or workstation.
Technical details
A race condition exists in mm/pagewalk.c within the walk_pud_range() and walk_pmd_range() functions. The vulnerability occurs when the splitting of a Page Upper Directory (PUD) entry races with a concurrent thread refaulting the PUD leaf entry. This causes the kernel to attempt to walk a Page Middle Directory (PMD) range that has already disappeared or changed, leading to an invalid memory access and a kernel BUG/Oops. The issue is specifically reproducible when reading numa_maps while VFIO-PCI is performing DMA setup (vfio_pin_pages_remote) on large BARs. The fix involves validating the PUD entry using a stable snapshot (pudp_get()) and retrying the walk if the entry is not present or is a leaf.
Affected products
- Linux Linux Kernel 6.12 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc5
Timeline
- 2026-03-25: disclosed: Initial patch authored
- 2026-04-22: advisory: NVD publication date