CVE-2026-31456
Race Condition in Linux Kernel mm/pagewalk Causes Kernel Panic
Publication date: 2026-04-22
Last updated on: 2026-05-05
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.12 (inc) to 6.18.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the function walk_pud_range(). It involves a race condition between the splitting of a Page Upper Directory (PUD) entry and a concurrent thread refaulting the PUD leaf entry.
The race can cause the kernel to attempt walking a Page Middle Directory (PMD) range that no longer exists, leading to a kernel BUG and a crash. An example scenario is when reading the numa_maps of a process while VFIO-PCI is setting up Direct Memory Access (DMA) on a large Base Address Register (BAR) for that process.
The fix involves validating the PUD entry using a stable snapshot and retrying the walk if the PUD is not present or is a leaf, preventing the kernel from descending into an invalid memory range.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash with a kernel BUG when the race condition is triggered. This can lead to system instability, unexpected reboots, or denial of service.
Specifically, processes interacting with VFIO-PCI and performing memory operations like reading numa_maps may trigger this bug, potentially disrupting critical operations that rely on stable kernel memory management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel BUG messages related to page faults occurring during concurrent memory operations, such as reading numa_maps of a process while VFIO-PCI is setting up DMA on a large BAR.
Specifically, look for kernel BUG messages similar to the following in your system logs: "BUG: unable to handle page fault for address" followed by a stack trace involving walk_pgd_range and walk_pmd_range functions.
You can monitor your kernel logs for such BUG messages using commands like:
- dmesg | grep -i 'BUG: unable to handle page fault'
- journalctl -k | grep -i 'BUG: unable to handle page fault'
Additionally, reproducing the issue involves reading /proc/[pid]/numa_maps of a process while VFIO-PCI is performing DMA setup, but this is more of a test scenario than a detection command.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation for this vulnerability is to update the Linux kernel to a version where the race condition between concurrent split and refault in the memory management pagewalk code has been fixed.
The fix involves validating the PUD entry in walk_pmd_range() using a stable snapshot and retrying the walk if the PUD is not present or is a leaf, preventing the kernel BUG from occurring.
Until the kernel is updated, avoid running workloads that simultaneously read numa_maps of a process while VFIO-PCI is setting up DMA on large BARs, as this triggers the bug.