Executive brief
The Linux kernel's memory management subsystem failed to preserve user-initiated memory protection flags when downgrading device-private huge page memory descriptors. This could allow an attacker or buggy application to bypass memory access traps on swapped-in pages, potentially exposing protected memory or disrupting memory protection mechanisms that rely on these traps.
Technical details
The vulnerability exists in the mm/huge_memory.c function change_non_present_huge_pmd(), which converts writable device-private PMD (Page Middle Directory) swap entries into readable ones during mprotect() operations. The function failed to carry forward the pmd_swp_uffd_wp() flag (userfaultfd write-protect bit) across the conversion, unlike the equivalent PTE-level function change_softleaf_pte(). Without this flag preservation, a plain mprotect() over a UFFD_WP-marked device-private transparent huge page would strip the protection bit, causing memory access traps to be bypassed on swap-in. The fix adds two lines to check and preserve the UFFD_WP flag during the entry rewrite. No special preconditions or authentication are required; any process using mprotect() on device-private THPs with UFFD_WP flags is affected.
Affected products
- Linux Linux kernel Versions with device-private THP support in PMD operations (from commit 368076f52ebe onwards)
Timeline
- 2026-05-29: disclosed: Commit authored by Kiryl Shutsemau
- 2026-06-08: patched: Upstream fix applied by Andrew Morton
- 2026-07-24: patched: Fix backported to stable trees by Greg Kroah-Hartman
- 2026-08-15: advisory: CVE-2026-72180 published