Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash. The issue occurs when the system handles specific memory diagnostic requests (madvise) simultaneously with memory unmapping operations. This results in a 'deadlock' where the system becomes unresponsive or crashes, potentially disrupting operations and requiring a reboot.
Technical details
A race condition exists in the Linux kernel's HugeTLB memory management. Specifically, the function `__get_huge_page_for_hwpoison()` in `mm/memory-failure.c` could call `folio_put()` while the `hugetlb_lock` was still held by its wrapper. If a concurrent `unmap` operation reduced the folio's reference count to zero, `folio_put()` would trigger `free_huge_folio()`, which attempts to re-acquire the same `hugetlb_lock`. Since this spinlock is non-recursive, it results in an AA deadlock. The fix involves moving the lock acquisition and ensuring the lock is released before `folio_put()` is called. This is a local denial-of-service vulnerability requiring specific memory management syscalls.
Affected products
- Linux Linux Kernel 405ce051236c
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Wupeng Ma
- 2026-05-28: patched: Committed to mainline by Andrew Morton
- 2026-06-25: advisory: CVE-2026-53207 published
References
- https://git.kernel.org/stable/c/3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e
- https://git.kernel.org/stable/c/77b73b54801ae7137479c141fd0473a491c1dc48
- https://git.kernel.org/stable/c/a33bfed648c10f5a1519981dbfad80841191edc8
- https://git.kernel.org/stable/c/bf7ba8f96c258c30393814491930ae4ecdc5fe5e
- https://git.kernel.org/stable/c/dd77a83915b07e2b0205adb284f08b39ae31dc4b
- https://git.kernel.org/stable/c/fc3ff42cb0cbf947e4600ae9761c3783760050e2