Executive brief
A vulnerability was identified in the Linux kernel's memory management system. This issue could potentially allow a local attacker to cause a system crash or read sensitive information from memory that has already been freed. The flaw specifically affects how the system tracks memory usage for large files.
Technical details
A use-after-free vulnerability exists in mm/huge_memory.c within the Linux kernel. The function __split_huge_pmd_locked() incorrectly updated the Resident Set Size (RSS) counter for file/shmem mappings after releasing the folio reference via folio_put(). If folio_put() triggered the destruction of the folio, the subsequent call to mm_counter_file() would attempt to access the freed folio state to determine if it was swap-backed. This race condition can be exploited by a local user to cause a kernel oops or potentially leak information. The fix reorders the operations to ensure the counter is updated while the folio reference is still held.
Affected products
- Linux Linux 4.19 to 5.10.259, 5.15.210, 6.1.176, 6.6.143
Timeline
- 2026-06-25: advisory: CVE published by NVD
- 2026-06-19: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877
- https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59
- https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad
- https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce
- https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9
- https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8
- https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194