Executive brief
A bug in the Linux kernel's memory management code causes the system to crash when attempting to read memory metadata during dynamic memory removal operations on large systems. The kernel incorrectly tries to access non-existent memory regions (vmemmap holes), resulting in a fault that can interrupt normal operations during system reconfiguration.
Technical details
A bounds-checking error in the snapshot_page() function in mm/util.c causes an out-of-bounds memory read. The vulnerable code checks if nr_pages > 1 before accessing __page_2, but should instead check if nr_pages > 2, since __page_2 only exists in folios with 3 or more pages. When an order-1 folio (2 pages) is allocated at the end of a vmemmap section, the adjacent __page_2 region may fall in unmapped memory (a vmemmap hole). This causes a fault during page isolation on the DLPAR (Dynamic Logical Partitioning) memory removal path. The fix is a single-line change from "nr_pages > 1" to "nr_pages > 2", which prevents reading non-existent metadata. A patch is available in upstream Linux kernel stable trees as of v6.15+.
Affected products
- Linux Linux kernel v6.15 and later
Timeline
- 2026-08-28: disclosed
- 2026-07-20: patched: Fix merged upstream by Andrew Morton