CVE-2026-74632

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there. This results in huge_zero_folio being correctly set but huge_zero_pfn b...

Affected product and versions

Product

Linux

Affected versions

>= 6527d8ef68c3ca3c455e38ae2a37cd7810caec73 < 9c0fd1802ce06d7709f0bae4edeb085288f28764, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < b7041ba61c5da4e0b56f9be58cfb87d7689724e4, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < 9332b080ad57650d1dc582e54517f9fc78ef89cc, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < f3a874a903053c53fb53ba287ea9eacda69c68e8, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < 6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < 105d04edbec83010df5728f74d17fd9c108e7553, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < ab7e4b407c7f58d1a003134eff3841f303d5ccc2, >= 3b77e8c8cde581dadab9a0f1543a347e24315f11 < 33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb, >= fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8, >= bd092a0f19423d7e9e81182314a96ecd6a14f3b7, >= b1daf8f862136894a4595770a44e4508808fb806, >= 5.10.47 < 5.10.267, >= 4.19.197 < 4.20, >= 5.4.129 < 5.5, >= 5.12.14 < 5.13, >= 5.13

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available