Executive brief
A synchronization issue in the Linux kernel's memory management system could allow a local user to cause a system crash or instability. The problem occurs during specific memory operations on ARM64-based systems, where the system fails to properly coordinate between splitting large memory pages and cleaning up unused memory entries. This can lead to the kernel attempting to modify memory data without the necessary safety locks, resulting in a system failure.
Technical details
A race condition exists in mm/huge_memory due to a missing memory barrier in softleaf_to_folio(). On ARM64 systems, when multi-size Transparent Huge Pages (mTHP) are split concurrently with zap_nonpresent_ptes(), the lack of an smp_rmb() (read memory barrier) in softleaf_to_folio() allows the CPU to see updated compound_head information before the page flags (including PG_locked) are visible. This results in a folio being modified without the required lock, triggering a VM_WARN_ON_ONCE() or a BUG_ON() in older kernels. The fix involves adding the missing smp_rmb() to ensure proper synchronization between the migration entry access and the folio split operation.
Affected products
- Linux Linux Kernel v6.19-rc1
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-03-19: other: Initial patch submission
- 2026-04-18: patched: Committed to stable tree
- 2026-04-22: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617
- https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669
- https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea
- https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769
- https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41
- https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7
- https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8