CVE-2026-64181
Received Received - Intake

Memory Corruption in Linux Kernel via Missing pmd_special Support

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a "WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by "BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when reclaim gets to call shrink_huge_zero_folio_scan(). It's as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and indeed, whereas pte_special() and pte_mkspecial() are subject to a dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial() are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on any 32-bit architecture. While the problem was exposed through commit d80a9cb1a64a ("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an oversight in commit af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") and would result in other problems: * huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and numamaps as file-backed THP * folio_walk_start() returning the folio even without FW_ZEROPAGE set. Callers seem to tolerate that, though. ... and triggering the VM_WARN_ON_ONE(), although never reported so far. To fix it, teach vm_normal_page_pmd()/vm_normal_page_pud() to consider whether pmd_special/pud_special is actually implemented.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64181
EUVD
EUVD-2026-45866

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel on x86 32-bit systems with THP enabled. It occurs when zap_huge_pmd() fails to set the _PAGE_SPECIAL bit in huge_zero pmd, leading to warnings and bugs in memory management. The issue stems from missing support for pmd_special()/pud_special() in 32-bit architectures, causing incorrect handling of huge zero pages.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires checking kernel logs for warnings or bugs related to mm/memory.c or rss-counter states. Look for messages like 'WARNING: mm/memory.c:735' or 'BUG: Bad rss-counter state' in system logs. No specific commands are provided for detection.

Impact Analysis

This vulnerability can cause system instability on affected systems, including warnings and crashes during memory operations. It may also lead to incorrect accounting of huge zero pages in tools like smaps and pagemap, potentially affecting performance monitoring and debugging.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel memory management issue that could lead to incorrect accounting of memory pages, but there is no evidence it impacts data protection or privacy controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. The vulnerability is fixed by ensuring vm_normal_page_pmd()/vm_normal_page_pud() consider pmd_special/pud_special implementation. Check your distribution's security advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart