Executive brief
A bug in the Linux kernel's memory management (khugepaged) can cause data loss when transparent huge pages are collapsed on files that have been previously written to. When an attacker or process triggers page collapse at the right moment after file writes, dirty data in memory may be discarded without being written to disk, resulting in permanent data loss for affected files.
Technical details
The vulnerability is a data loss condition in mm/khugepaged's collapse_file() function. The root cause is a race condition: while khugepaged excludes files open for writing, it does not account for dirty folios left behind by previous writers. An attacker can exploit this edge case by: (1) opening a file for writing and writing data, (2) closing it, (3) calling madvise(MADV_COLLAPSE) on the file's memory mapping, (4) reopening the file for writing. When truncate_inode_pages() is called during the subsequent open, transparent huge pages are cleared along with their associated dirty folios, causing unwritten data to be discarded. The fix involves fully writing back the page cache and holding the invalidate_lock during collapse to prevent concurrent page cache truncation by do_dentry_open().
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-10: disclosed