Executive brief
The Linux kernel's memory management system fails to properly initialize data structures when DAX (Direct Access) memory is added to certain zones, potentially leaving internal page metadata in an inconsistent state. This can lead to unpredictable crashes or unexpected behavior on systems using DAX-enabled persistent memory devices.
Technical details
This vulnerability is a memory initialization bug in the kernel's mm/mm_init.c module, specifically in the compound_nr_pages() function. When DAX memory is hotplugged into an unoccupied subsection of an early kernel section, the code reuses the unoptimized boot memmap but incorrectly calculates the number of struct pages to initialize, treating it as though vmemmap optimization was in effect. As a result, tail struct pages remain uninitialized, leading to undefined behavior or crashes. The fix adds a check for early sections before calculating struct page counts, ensuring that unoptimized boot memmaps are handled correctly. The vulnerability requires DAX memory hotplug operations on affected kernel versions (fixes commit 6fd3620b3428).
Affected products
- Linux Linux kernel multiple versions (see stable kernels 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed
- 2026-04-28: patched: Upstream patch committed; backported to stable branches