Junglewise Threat Intelligence

CVE-2026-64514: Linux kernel indefinite sleep in userfaultfd lockless PTE check

CVE-2026-64514 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's memory management system, specifically within the userfaultfd component used for handling page faults in user space. Under certain conditions involving memory migration or swapping, the system could incorrectly interpret memory state data, causing a thread to hang indefinitely. This results in a local denial-of-service where specific applications or processes may stop responding until a manual wake-up signal is received or the system is restarted.

Technical details

A vulnerability exists in userfaultfd_must_wait() and userfaultfd_huge_must_wait() within the Linux kernel. These functions read a Page Table Entry (PTE) without acquiring the page table lock and subsequently call pte_write() or huge_pte_write(). When a PTE is in a swap or migration state (non-present), these accessors incorrectly decode offset bits as writability flags, leading to undefined results. If the 'garbage' bits indicate the thread should wait, the process may remain asleep indefinitely because the expected UFFDIO_WAKE signal may never be triggered for a page in transit. The fix involves gating the writability check with pte_present() to ensure only valid present-PTE bits are inspected.

Affected products

  • Linux Linux kernel 369cd2121be4 to a5700a4c1c90

Timeline

  • 2026-07-02: disclosed: Initial patch authored by Kiryl Shutsemau
  • 2026-07-24: patched: Patch committed to stable trees by Greg Kroah-Hartman
  • 2026-07-25: advisory: CVE-2026-64514 published

References

Related threats