Executive brief
A race condition in the Linux kernel's file mapping subsystem can cause memory pages to be stored at incorrect indices in the xarray data structure. This can lead to executable code being placed at wrong memory addresses, resulting in application crashes (SIGILL/SIGSEGV signals) and potential data corruption. Systems running affected kernel versions may experience intermittent instability and unexpected process terminations.
Technical details
The vulnerability is a race condition in __filemap_add_folio() within the split-a-conflict retry loop. When xas_set_order() modifies xas.xa_index and a GFP_NOWAIT allocation fails, the lock is released for memory allocation. Upon reacquisition, if another thread has resolved the conflict, the function may store the folio at an incorrect (rounded-down) index rather than the intended index, violating folio_contains() invariants. The attack vector is local/network-reachable through normal kernel operations; no user interaction or authentication is required. An attacker could trigger memory corruption leading to privilege escalation or denial of service. The fix restores the original xas.xa_index before retry to ensure full re-evaluation after lock reacquisition.
Affected products
- Linux Linux kernel affected versions unknown
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: patch available in kernel tree