Executive brief
A vulnerability in the Linux kernel's memory management system can cause the operating system to crash. This occurs when the system attempts to reclaim memory from specific types of large data structures, leading to internal accounting errors. An exploit could result in a complete system outage, impacting service availability.
Technical details
A vulnerability exists in the 'try_to_unmap_one' function within mm/rmap.c of the Linux kernel. The root cause is the failure to re-initialize the 'nr_pages' variable to 1 at the start of each loop iteration. When processing lazyfree large folios, a previous call to 'folio_unmap_pte_batch' can set 'nr_pages' to a value greater than 1; if a subsequent iteration involves a device-exclusive PTE that does not trigger a new batch call, the stale 'nr_pages' value is reused. This leads to incorrect folio refcount and mapcount updates, resulting in kernel crashes. The issue is specifically reproducible using MAP_ANONYMOUS, MADV_FREE, and HMM_DMIRROR_EXCLUSIVE. Patches have been released for various stable branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux 6.15 to 6.18.35, 7.0.12
Timeline
- 2026-05-18: disclosed: Initial patch submission by Dev Jain
- 2026-07-19: advisory: CVE-2026-63950 published