CVE-2026-31397
NULL Pointer Dereference in Linux Kernel move_pages_huge_pmd
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the function move_pages_huge_pmd(). The function handles moving huge pages, including huge zero pages, but incorrectly uses a NULL folio as a sentinel value. This leads to passing NULL through functions that expect valid memory references, which on some memory models results in creating a page middle directory (PMD) entry pointing to non-existent physical memory, and on others causes a NULL pointer dereference.
The root cause is that the code reconstructs the destination PMD entry incorrectly for huge zero pages, dropping special PMD state flags. This causes the system to treat special huge zero page mappings as normal pages, potentially corrupting reference counts and memory management metadata.
The fix involves properly obtaining the valid huge zero folio from the page instead of using NULL, and preserving PMD metadata by deriving the destination PMD entry correctly and marking it with appropriate flags.
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption or system crashes due to invalid memory references or corrupted reference counts in the Linux kernel's memory management. Specifically, it can cause the kernel to reference non-existent physical memory or dereference NULL pointers, potentially leading to system instability or denial of service.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved in the Linux kernel by fixing the handling of NULL folio in move_pages_huge_pmd(). To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix described in the commit d82d09e48219.
This update ensures that huge zero PMDs remain special and prevents corruption of reference counts by properly handling PMD metadata instead of reconstructing the PMD from the folio.