Executive brief
The Linux kernel's PowerPC memory management code incorrectly tracks physical page frame numbers when populating vmemmap structures for compound pages. This logic error can cause the kernel to make wrong decisions about page mapping configuration, potentially leading to memory corruption or system instability on affected PowerPC systems.
Technical details
The vulnerability is a logic error in the vmemmap_populate_compound_pages() function in arch/powerpc/mm/book3s64/radix_pgtable.c. The function manually tracks a page frame number (addr_pfn) in parallel with a virtual address (addr), but the increments do not properly match the rate at which the address advances through vmemmap space. Specifically, each PAGE_SIZE step in addr covers PAGE_SIZE / sizeof(struct page) struct page slots, so addr_pfn should advance by the same amount, but the manual increments (1, 2, or PMD_SIZE >> PAGE_SHIFT) do not account for this relationship. As a result, the computed pfn_offset can be wrong, causing incorrect head/tail page mapping decisions for compound pages. The fix derives addr_pfn directly from the current address rather than carrying it as inconsistent loop state. No authentication or special privilege is required; the vulnerability affects normal kernel memory initialization on PowerPC systems.
Affected products
- Linux Linux kernel multiple versions (see git history for exact range)
Timeline
- 2026-09-16: disclosed
- 2026-06-12: patched