Executive brief
A vulnerability in the Linux kernel for PowerPC systems could allow a local user to cause a system crash. The issue occurs during specific memory management operations when moving memory pages between different locations while simultaneously closing or unmapping memory regions. This results in a kernel panic (crash), which can disrupt system availability and ongoing operations.
Technical details
A race condition exists in the powerpc/64s architecture's handling of Page Middle Directory (PMD) migration entries. When the move_pages() syscall is invoked on a Transparent Huge Page (THP), an intermediate state occurs where the PMD entry is set as a migration swap entry. If a concurrent munmap() occurs, the kernel may trigger a VM_BUG_ON() in pmdp_huge_get_and_clear_full() because it expects the PMD to be present when it has already been transitioned to a swap entry. This affects systems using migration swap entries or device-private THP entries. The fix involves updating the PMD handling logic to correctly account for non-present migration entries during unmap operations.
Affected products
- Linux Linux Kernel powerpc/64s architecture
Timeline
- 2026-03-09: patched: Initial patch authored by Ritesh Harjani (IBM)
- 2026-06-24: disclosed: CVE published to NVD dataset