Executive brief
A vulnerability in the Linux kernel's memory management for ARM64 processors could lead to a system hang or performance degradation. On certain hardware configurations, the system may enter an infinite loop when trying to access memory, effectively causing a denial of service. This occurs because the kernel incorrectly assumes memory permissions have been updated when they actually remain restricted.
Technical details
A logic error exists in contpte_ptep_set_access_flags() within the Linux kernel's arm64 memory management code. The function uses a 'gathered' view of Page Table Entries (PTEs) in a contiguous block to determine if an access flag update is a no-op. Because it ORs flags from all sub-PTEs, a 'dirty' or 'accessed' bit in a sibling PTE can cause the function to incorrectly return 0 (no-op) even if the target sub-PTE still has restrictive hardware permissions (e.g., PTE_RDONLY). On hardware without FEAT_HAFDBS or on SMMUs without HTTU, the page-table walker evaluates descriptors individually, leading to an infinite fault loop as the hardware continues to fault on the un-updated PTE. The fix involves checking each sub-PTE individually against the requested flags using raw values.
Affected products
- Linux Linux Kernel arm64 architecture with CONT PTE support
Timeline
- 2026-03-05: other: Patch authored by Piotr Jaroszynski
- 2026-05-13: disclosed: CVE published
- 2026-05-13: patched: Fixes merged into stable kernel branches