Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when the kernel incorrectly handles memory cleanup for certain hardware configurations, specifically those using PowerPC architecture with large page sizes. This could lead to a 'double free' condition, impacting system stability and security.
Technical details
A double-free vulnerability exists in mm/kasan/init.c within the Linux kernel. The root cause is that kasan_free_pxd() and related functions (kasan_free_pte, kasan_free_pmd, kasan_free_pud, kasan_free_p4d) incorrectly assumed page table entries were always struct page aligned. On architectures like PowerPC with 64K page sizes, PUD tables may be allocated from slab caches rather than being page-aligned, leading to incorrect memory address calculations during deallocation. An attacker with local access could trigger this during memory unmapping operations (e.g., using PMEM or ZONE_DEVICE) to cause a kernel panic or achieve arbitrary code execution. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.7 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-02-24: other: Vulnerability fixed in upstream kernel source
- 2026-04-27: advisory: CVE published
- 2026-06-01: patched: Patches applied to stable kernel branches
References
- https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db
- https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e
- https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b
- https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c
- https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4
- https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103
- https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576