CVE-2026-31466
Race Condition in Linux Kernel mm/huge_memory Causes Folio Locking Bug
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux | linux_kernel | 6.19-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's memory management subsystem, specifically in the handling of huge memory pages on arm64 servers. The issue arises because a function called softleaf_to_folio() does not properly lock a memory folio when accessing it, due to a missing memory barrier (smp_rmb()).
The problem occurs during a race condition between two kernel operations: splitting a huge transparent huge page (mTHP) and a function called zap_nonpresent_ptes(). Because of the missing memory barrier, softleaf_to_folio() may see inconsistent page flags, leading to a folio being modified without holding the proper lock.
This race condition can trigger warnings or bugs in the kernel (VM_WARN_ON_ONCE() or BUG_ON()), indicating that the kernel's memory management is in an inconsistent state.
The fix involves adding the missing memory barrier (smp_rmb()) in softleaf_to_folio() and softleaf_to_page() functions to ensure proper synchronization and locking.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to encounter race conditions in memory management, potentially leading to kernel warnings or crashes.
Such instability can affect system reliability and availability, especially on arm64 servers using huge memory pages.
While the description does not explicitly mention security exploits like privilege escalation or data leakage, kernel crashes or instability can disrupt services and lead to denial of service conditions.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability has been fixed by adding a missing memory barrier (smp_rmb()) in the Linux kernel functions softleaf_to_folio() and softleaf_to_page().
To mitigate this vulnerability immediately, you should update your Linux kernel to version 6.19-rc1 or later, where the fix has been merged.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to a race condition in the Linux kernel's memory management on arm64 servers, specifically involving folio locking during migration entries. Detection would typically involve monitoring kernel logs for warnings or errors triggered by this race condition.
Since the issue triggers VM_WARN_ON_ONCE() in pfn_swap_entry_folio(), you can check your system's kernel logs (e.g., using dmesg or journalctl) for messages related to VM_WARN or BUG_ON events that indicate folio locking problems.
Suggested commands to detect potential symptoms include:
- dmesg | grep -i 'VM_WARN_ON_ONCE'
- journalctl -k | grep -i 'VM_WARN_ON_ONCE'
- journalctl -k | grep -i 'BUG_ON'
Additionally, monitoring for kernel crashes or instability on arm64 servers running affected kernel versions before v6.19-rc1 may help identify the presence of this issue.