high 7.8

CVE-2026-74632 json

mm/huge_memory: fix huge_zero_pfn race

published 2026-08-22 2 mo ago modified 2026-10-24 16 d ago also EUVD-2026-64569

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

Patch series "mm/huge_memory: fix huge_zero_pfn race", v2.

There is a subtle race in the reference-counted huge_zero_folio implementation.

The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there.

This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio.

This can result in the huge zero folio being split and otherwise treated incorrectly.

The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully.

The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own.

The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one.

This patch (of 2):

If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted by huge_zero_refcount and returned by mm_get_huge_zero_folio().

When the caller is done with the huge zero page, its reference count is decremented. Only a shrinker can set the reference count to zero.

A race can unfortunately occur between a shrinker decrementing the reference count to zero and a concurrent page fault.

This is because shrink_huge_zero_folio_scan() might, if very unlucky, be preempted between setting huge_zero_refcount to zero and writing an invalid value.

During this time get_huge_zero_folio() could write to huge_zero_pfn before shrink_huge_zero_folio_scan() resumes.

In this event the huge zero folio will be persistently misidentified causing the THP code path to be entered inappropriately for the huge zero folio:

CPU 0 CPU 1 =======================================|================================= shrink_huge_zero_folio_scan() | atomic_cmpxchg() sets refcount to 0 | xchg() sets huge_zero_folio to NULL | get_huge_zero_folio() | | atomic_inc_not_zero() -> zero preempted for a long time | Allocate new huge zero folio | | Write valid huge_zero_folio v | Write valid huge_zero_pfn Overwrite huge_zero_pfn with ~0UL <--- Invalid overwrite!

This results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly returning false for a huge zero page which could result in issues like the huge zero folio being incorrectly split.

Note that the issue is with huge_zero_pfn not huge_zero_folio, as get_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL with a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set huge_zero_folio.

Fix the issue by introducing a spinlock, huge_zero_lock, to prevent concurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount.

There needs to be significant care taken here to ensure correctness:

The fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which is outside of the critical section, and means huge zero allocation is gated on zero huge_zero_refcount.

The fast path doesn't use huge_zero_lock, so the critical section is irrelevant to it.

So invariants are required - huge_zero_refcount MUST:

* Only be set in the huge_zero_lock critical section to ensure serialisation of huge_zero_pfn, huge_zero_folio and ---truncated---

Patch / fix

fixed in 1 distros 5 links 8

Linux Linux 4.20, 5.5, 5.10.267, 5.13, 5.15.218, 6.1.184, 6.6.153, 6.12.104, 6.18.45, 7.1.9, 7.2

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.187-1
linux Debian 13 6.12.105-1
linux Debian 14 7.1.9-1
linux-6.12 Debian 12 6.12.107-1~deb12u1

debian advisories DEBIAN-CVE-2026-74632

linux Ubuntu 22.04 LTS 5.15.0-202.212
linux Ubuntu 26.04 LTS 7.0.0-42.42
linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
linux-ibm Ubuntu 22.04 LTS 5.15.0-1113.117

ubuntu advisories UBUNTU-CVE-2026-74632

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.84.1
kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.84.1
kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1.150700.17.47.1

suse advisories SUSE-SU-2026:4706-1 SUSE-SU-2026:4640-1 SUSE-SU-2026:24316-1 SUSE-SU-2026:24315-1 SUSE-SU-2026:24181-1 SUSE-SU-2026:24182-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.39.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.39.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.39.1

opensuse advisories openSUSE-SU-2026:22091-1

kernel Azure Linux 3.0 6.6.157.1-1

azure linux advisories AZL-97130

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-74632 updated 2026-11-05 cvss 5.5

kernel: mm/huge_memory: fix huge_zero_pfn race

Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: workaround, no fix available “Fix deferred”
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-74632
NVD CVE-2026-74632

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary