Executive brief
The Linux kernel contains a memory management bug affecting hugetlb pages that can corrupt page migration state when a process forks while migrating large pages or after a memory error. This corrupts the physical page mapping in child processes, potentially leading to memory corruption or data loss when those pages are later accessed or relocated.
Technical details
A vulnerability in copy_hugetlb_page_range() incorrectly clears the user-fault-FD write-protect (uffd-wp) bit on migration and hwpoison entries using huge_pte_clear_uffd_wp(), which operates on the wrong bit position for swap entries. For swap entries, the uffd-wp state is stored separately via pte_swp_uffd_wp(), not in the present-PTE position; clearing at the wrong position corrupts the swap offset encoding. On x86-64, naturally-aligned hugetlb page frame numbers have the affected bit set, causing the offset to advance by two pages. The corruption occurs during fork() without requiring userfaultfd registration on the child VMA, affecting any in-flight migration entry or poisoned page. The fix uses pte_swp_clear_uffd_wp() for migration entries (which legitimately carry uffd-wp) and removes the clear for hwpoison entries (which never carry the bit).
Affected products
- Linux Linux kernel versions prior to fix (date of fix not specified in advisory)
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix merged into Linux kernel