Executive brief
The Linux kernel has a race condition in its transparent huge page (THP) memory management that can cause the system to misidentify special memory pages used for optimization. This occurs when the memory management subsystem's garbage collection interferes with page allocation, potentially causing incorrectly split memory pages and system instability. While exploitability is limited, the bug can lead to memory management errors and potential denial of service conditions.
Technical details
A race condition exists in the Linux kernel's huge_zero_folio implementation (mm/huge_memory) when CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is disabled. The vulnerability occurs between the shrinker decrementing the huge_zero_refcount to zero and the concurrent allocation path updating huge_zero_pfn. If the shrinker is preempted after clearing the refcount but before invalidating huge_zero_pfn, a racing get_huge_zero_folio() can write a valid huge_zero_pfn value that the shrinker subsequently overwrites with an invalid sentinel value (~0UL). This causes is_huge_zero_pfn() and is_huge_zero_pmd() to misidentify the huge zero folio, potentially leading to incorrect folio splitting and improper THP handling. The fix introduces a spinlock (huge_zero_lock) to serialize writes to huge_zero_folio, huge_zero_pfn, and huge_zero_refcount, with careful ordering guarantees for weakly ordered architectures. No preconditions are required; the race can occur during normal page fault and memory pressure operations on affected kernel versions.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: Fix introduced via spinlock serialization of huge_zero_* state