Към съдържанието
Търсене

CVE-2026-74632: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there. This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio. This can result in the huge zero folio being split and otherwise treated incorrectly. The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully. The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own. The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one. This patch (of 2): If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted by huge_zero_refcount and returned by mm_get_huge_zero_folio(). When the caller is done with the huge zero page, its reference count is decremented. Only a shrinker can set the reference count to zero. A race can unfortunately occur between a shrinker decrementing the reference count to zero and a concurrent page fault. This is because shrink_huge_zero_folio_scan() might, if very unlucky, be preempted between setting huge_zero_refcount to zero and writing an

Засегнати продукти

  • Linux Linux: 6527d8ef68c3ca3c455e38ae2a37cd7810caec73 преди 9c0fd1802ce06d7709f0bae4edeb085288f28764; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди b7041ba61c5da4e0b56f9be58cfb87d7689724e4; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди 9332b080ad57650d1dc582e54517f9fc78ef89cc; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди f3a874a903053c53fb53ba287ea9eacda69c68e8; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди 6024f6d0d9b9ca5138bfc4ac6f6e4bdf616e42b3; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди 105d04edbec83010df5728f74d17fd9c108e7553; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди ab7e4b407c7f58d1a003134eff3841f303d5ccc2; 3b77e8c8cde581dadab9a0f1543a347e24315f11 преди 33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb; fc1fbc5b017b6f5ef24a4a93f33cd022225e01c8; bd092a0f19423d7e9e81182314a96ecd6a14f3b7; b1daf8f862136894a4595770a44e4508808fb806; 5.10.47 преди 5.10.267; 4.19.197 преди 4.20; 5.4.129 преди 5.5; 5.12.14 преди 5.13
  • Linux Linux: 5.13; преди 5.13; 5.10.267 до 5.10.*; 5.15.218 до 5.15.*; 6.1.184 до 6.1.*; 6.6.153 до 6.6.*; 6.12.104 до 6.12.*; 6.18.45 до 6.18.*; 7.1.9 до 7.1.*; от 7.2 нататък

История

  • 22 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74632: Linux | freedomonline.bg