CVE-2026-89987

A flaw was found in the Linux kernel's huge memory management. This vulnerability can lead to silent data loss for applications utilizing shared memory segments MAPSHARED tmpfs when Transparent Huge Pages THP and swap are active. The system fails to correctly mark modified memory as 'dirty,'...

CVE-2026-98505

A flaw was found in the Linux kernel. A race condition within the Data Access Monitor DAMON subsystem allows hardware-driven page table updates to be lost during the monitoring of huge memory pages. A local user running processes monitored by DAMON can trigger concurrent memory operations,...

CVE-2026-79609 x86: XPTI may break on huge-memory systems

XPTI Xen Page Table Isolation was introduced to mitigate Meltdown CVE-2017-5754, one aspect of XSA-254. This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the...

CVE-2026-79609

The Xen hypervisor contains a vulnerability where XPTI (Xen Page Table Isolation) may break on huge-memory systems . This occurs because PV guests use a directmap that may not cover all memory if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary during the copying of...

CVE-2026-79609 x86: XPTI may break on huge-memory systems

XPTI Xen Page Table Isolation was introduced to mitigate Meltdown CVE-2017-5754, one aspect of XSA-254. This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: use !CONFIG64BIT to relax huge page alignment on 32-bit machines Yves-Alexis Perez reported a commit 4ef9ad19e176 “mm: hugememory: don’t force huge page alignment on 32-bit machines” which did not work for x8632 1...

SUSE CVE-2026-80729

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: initialise workingset state before folio split xastrysplit adds GFPACCOUNT for page-cache xanodes, but foliosplit leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked...

CVE-2026-80729

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: initialise workingset state before folio split xastrysplit adds GFPACCOUNT for page-cache xanodes, but foliosplit leaves the xastate's xalru unset. That lets a live, memcg-charged xanode exist without being linked...

PT-2026-84927

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where xas try split adds GFP ACCOUNT for page-cache xa nodes, but folio split fails to set the xa lru of the xa state. This allows a live, memcg-charged xa node to exist...

Linux kernel memory management Heap Buffer Overflow DoS

The vulnerability of the filethpenabled function in the mm/hugememory.c module of the Linux kernel’s memory management subsystem is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

CVE-2026-74482

A flaw was found in the Linux kernel's huge memory management mm/hugememory. A race condition exists in the foliosplit function where the immaprwsem lock is released prematurely before all after-split folios are fully processed. This allows a concurrent operation to free the inode while subsequen...

UBUNTU-CVE-2026-74482

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72180

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72180 mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-72180

CVE-2026-72180 affects the Linux kernel’s huge memory handling (mm/huge_memory). The root cause is that during device-private PMD downgrade, the pmd_swp_uffd_wp flag can be lost when the swap entry is rewritten, allowing a plain mprotect() on a UFFD_WP-marked device-private THP to strip the flag ...

CVE-2026-72180 mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable one without carrying pmdswpuffdwp across. The PTE-level...

CVE-2026-68163

The CVE-2026-68163 entry concerns Linux kernel memory management: device-private PMD handling in page_vma_mapped_walk() and related code paths. Root cause was improper handling of device-private PMD entries after adding device-private support, leading to cases where PMD entries with PFNs could be...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...