Executive brief
A vulnerability was identified in the Linux kernel's memory management system, specifically within the memfd_luo component used for preserving memory across system events. The flaw occurs during error cleanup, where the system incorrectly calculates physical memory addresses and fails to validate empty memory slots. This could lead to improper memory handling or system instability when the kernel attempts to recover from a failed memory retrieval operation.
Technical details
A logic error exists in the memfd_luo_retrieve_folios() cleanup path within the Linux kernel. Specifically, kho_restore_folio() was incorrectly passed a raw Page Frame Number (PFN) instead of a physical address (phys_addr_t), causing the kernel to validate incorrect memory locations. Additionally, the cleanup loop lacked a check for null PFNs, which could lead to the incorrect processing of sparse file holes (pfn=0). An attacker or a system error triggering the cleanup path could cause the kernel to perform incorrect folio restoration or reference invalid memory addresses. The issue has been resolved by applying PFN_PHYS() conversion and adding the necessary PFN validation checks.
Affected products
- Linux Linux Kernel Fixed in commits 3538f90 and bd0d6bd
Timeline
- 2026-03-26: disclosed: Initial patch submitted by Chenghao Duan
- 2026-05-27: advisory: NVD publication date