Executive brief
A vulnerability in the Linux kernel's LoongArch architecture implementation causes dirty page tracking information to be lost during memory fork operations, potentially leading to data corruption. When pages are reclaimed by the operating system, they may be freed without being written back to disk, resulting in permanent loss of unsaved data.
Technical details
The vulnerability exists in the pte_wrprotect() and pmd_wrprotect() functions on LoongArch when hardware page table walking (PTW) is enabled. The bug occurs due to a race condition where the hardware PTW sets the _PAGE_DIRTY bit directly in page table entries, but the software-only _PAGE_MODIFIED bit is not set. During copy-on-write operations in fork()/clone(), pte_wrprotect() unconditionally clears both _PAGE_WRITE and _PAGE_DIRTY bits without checking if _PAGE_MODIFIED should be preserved, causing the kernel to lose track of dirty pages. Subsequently, page reclaim may free dirty pages without writeback, causing data loss. The fix propagates the _PAGE_DIRTY bit to _PAGE_MODIFIED before clearing writable bits in both pte_wrprotect() and pmd_wrprotect(). This is a local attack vector affecting systems running vulnerable LoongArch kernels.
Affected products
- Linux Linux kernel LoongArch architecture versions with hardware page table walking enabled
Timeline
- 2026-08-15: disclosed
- patched: Fix applied to pte_wrprotect() and pmd_wrprotect() functions