Executive brief
The Linux kernel's memory hotplug subsystem contains a bug in error handling that can lead to memory corruption. When adding memory dynamically fails after initial setup succeeds, the cleanup code incorrectly frees virtual memory map pages back to the system instead of returning them to reserved memory. This can cause the system to allocate and use pages it does not own, resulting in machine crashes or silent data corruption.
Technical details
This vulnerability is a logic error in the create_altmaps_and_memory_blocks() function within mm/memory_hotplug.c. When arch_add_memory() succeeds with memmap_on_memory enabled, virtual memory map (vmemmap) pages are allocated from params.altmap. If create_memory_block_devices() subsequently fails, the error path invokes arch_remove_memory() with a NULL altmap parameter instead of params.altmap. This causes vmemmap_free() to fall back to the generic free_pages() path rather than properly returning pages to the altmap allocator. The function then immediately destroys the physical linear mapping for this memory, injecting unowned pages into the buddy allocator. A later allocation and use of these pages triggers machine check exceptions or memory corruption. The fix is straightforward: pass params.altmap instead of NULL to arch_remove_memory() in the error path. This is a local denial-of-service and data corruption issue with no network attack vector.
Affected products
- Linux Linux Kernel Multiple versions, patched in stable branches
Timeline
- 2026-08-15: disclosed
- 2026-04-28: patched: Fix authored by Muchun Song