CVE-2026-23375
Received Received - Intake
THP Bypass on Linux Kernel Anonymous Inodes Causes Kernel Crash

Publication date: 2026-03-25

Last updated on: 2026-04-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which does not call get_write_access() and leaves inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being true, they appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP collapse. Anonymous inodes can never pass the inode_is_open_for_write() check since their i_writecount is never incremented through the normal VFS open path. The right thing to do is to exclude them from THP eligibility altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real filesystem files (e.g. shared libraries), not for pseudo-filesystem inodes. For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create large folios in the page cache via the collapse path, but the guest_memfd fault handler does not support large folios. This triggers WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). For secretmem, collapse_file() tries to copy page contents through the direct map, but secretmem pages are removed from the direct map. This can result in a kernel crash: BUG: unable to handle page fault for address: ffff88810284d000 RIP: 0010:memcpy_orig+0x16/0x130 Call Trace: collapse_file hpage_collapse_scan_file madvise_collapse Secretmem is not affected by the crash on upstream as the memory failure recovery handles the failed copy gracefully, but it still triggers confusing false memory failure reports: Memory failure: 0x106d96f: recovery action for clean unevictable LRU page: Recovered Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all anonymous inode files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-24
Generated
2026-05-07
AI Q&A
2026-03-25
EPSS Evaluated
2026-05-05
NVD
CVE-2026-23375
EUVD
EUVD-2026-15365
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.8
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.17 (exc)
linux linux_kernel From 6.8.1 (inc) to 6.12.78 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's memory management related to Transparent Huge Pages (THP). Specifically, the function file_thp_enabled() incorrectly allows THP for files on anonymous inodes, such as guest_memfd and secretmem. These files are created in a way that they appear as read-only regular files, making them eligible for THP collapse even though they should not be.

Anonymous inodes never increment their write count through the normal file system open path, so they should be excluded from THP eligibility. Allowing THP on these files causes issues: for guest_memfd, it triggers warnings due to unsupported large folios; for secretmem, it can cause kernel crashes or confusing false memory failure reports.

The fix involves denying THP for all anonymous inode files by checking IS_ANON_FILE(inode) in the file_thp_enabled() function.


How can this vulnerability impact me? :

This vulnerability can lead to kernel warnings, crashes, and false memory failure reports when using certain types of anonymous inode files like guest_memfd and secretmem.

  • For guest_memfd, it can cause warnings due to unsupported large folios in the page cache.
  • For secretmem, it can cause kernel crashes due to failed memory operations or confusing false memory failure recovery messages.

Such instability can affect system reliability and may lead to unexpected behavior or downtime.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is resolved by denying Transparent Huge Pages (THP) for files on anonymous inodes by checking IS_ANON_FILE(inode) in file_thp_enabled().

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes this fix where THP is denied for anonymous inode files.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart