Executive brief
A vulnerability in the Linux kernel's memory management system could cause system instability or crashes on 32-bit x86 systems. The issue occurs when the system incorrectly handles specific types of large memory pages, leading to internal errors and 'bad page state' messages. This could result in a denial of service where the system becomes unresponsive or requires a reboot.
Technical details
A vulnerability exists in the Linux kernel's mm/memory.c within the __vm_normal_page() function. On 32-bit x86 architectures, the kernel failed to correctly identify 'special' pmd/pud entries because CONFIG_ARCH_SUPPORTS_PMD_PFNMAP is never enabled for 32-bit builds, unlike the pte-level equivalent. This oversight causes zap_huge_pmd() to misidentify huge zero pages, leading to incorrect RSS counter states and 'Bad page state' errors during page reclaim. An attacker could potentially trigger this kernel panic or memory corruption through local operations that manipulate Transparent Huge Pages (THP). The issue has been resolved by teaching the kernel to verify if pmd_special/pud_special is actually supported by the architecture before processing these entries.
Affected products
- Linux Linux Kernel 6.18 to 6.18.34, 7.0 to 7.0.11
Timeline
- 2026-04-30: disclosed: Initial patch submitted by David Hildenbrand
- 2026-05-13: patched: Patch committed to mainline kernel
- 2026-07-19: advisory: CVE-2026-64181 published