Executive brief
A bug in the Linux kernel's memory management can cause data loss when processes use large shared memory segments (tmpfs with huge pages). When a process writes data to a shared tmpfs region and then unmaps it, the kernel fails to properly track whether the data was modified, causing the data to be silently discarded instead of being preserved to swap. This affects applications that pass state between process generations via shared memory segments.
Technical details
The vulnerability is a missing dirty bit propagation in zap_huge_pmd_folio() when unmapping huge page (PMD) mappings in tmpfs. While the pte path correctly propagates the dirty bit to the folio via zap_present_folio_ptes(), the PMD path does not. For tmpfs, which lacks page_mkwrite() and vma_wants_writenotify(), read faults can install writable PMD mappings without marking the folio dirty. Subsequent writes only set the hardware dirty bit in the pmd; when the region is unmapped, the dirty bit is lost. During reclaim, the folio appears clean and is evicted via __remove_mapping() without creating a swap entry, resulting in silent data loss. The issue requires: (1) tmpfs with THP enabled, (2) a MAP_SHARED mapping, (3) swap enabled for reclaim to scan the folio, and (4) unmap before recovery. A patch propagating the pmd dirty bit to the folio at unmap time is available.
Affected products
- Linux Linux Kernel versions with tmpfs THP support enabled
Timeline
- 2026-09-16: disclosed