From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37A993AA4EA for ; Sun, 19 Jul 2026 15:47:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476059; cv=none; b=iuGUW3EzZsYFjVkVIyzNWQZYTKh33apcU9Se6yvVOyG+8xQZNOj0bW4cy+WNDqB4ndaFss+pn5WOQhoFQakE7kw9l6U1vZYAlh21P2dADP7rziCjmdkbc96yX0zIcRdE1gPK3e4BSbiaLK1vmfqsnkcft8y264tPy32ZK8r8CWg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784476059; c=relaxed/simple; bh=hGbtB6Ro46E0ypx3n2/Y+tu4UuHYsLnpBuIsYS1VNt0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YvPrYecj8jhA74CpBjg1J1YyuJTnbbmwA0A/mGp5AockD5RooauZetrmGJUrujeuenFezz+oyuJ0MLHZyX+R+aGXluMHZZGlHgQLMwGxkQ07E4ZVXZYg7nD9Cvd8d+uHIyRsyuELd+mfyqW1T8KIRQ64rmWe/AjCdequP3w7xjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iedA9gW6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iedA9gW6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A96B1F000E9; Sun, 19 Jul 2026 15:47:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784476058; bh=HmBWeKWyh0yl7umO+gJPGjOEQYBfvytGSuwmMIf1sto=; h=From:To:Cc:Subject:Date:Reply-To; b=iedA9gW6vBmOSmaUw+kUvG7iPcsS2TPM/05qmADNxOI1Ekbd2WFFmsItfow48gtvz f9pK0LPWDxsldm6nTcvccsWQOK/0ZyS6lH6dxXVu7F4f4QURoUgDUIxJFgx8Rr/Tiv q+OuvL5VZMQmaaWqwhxVRA3b0k2nLl7LFprhF0Xc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64181: mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() Date: Sun, 19 Jul 2026 17:40:43 +0200 Message-ID: <2026071938-CVE-2026-64181-e460@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3347; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=GWC0mNbfvJ1ye+1d7fQeS3rO15lSPhZLfusGFrw9DBI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx7+suhL7XNUvnPN9+gW/R8va9XXVBjAeaTxZayDC1N +0JCbraEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABeJZZhn0GP82dvrsdtkYR+F bKuSjqCIC/MYFuw5cX9rxO28WasOy2W8FOhRnWaeUwkA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a "WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by "BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when reclaim gets to call shrink_huge_zero_folio_scan(). It's as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and indeed, whereas pte_special() and pte_mkspecial() are subject to a dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial() are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on any 32-bit architecture. While the problem was exposed through commit d80a9cb1a64a ("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an oversight in commit af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") and would result in other problems: * huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and numamaps as file-backed THP * folio_walk_start() returning the folio even without FW_ZEROPAGE set. Callers seem to tolerate that, though. ... and triggering the VM_WARN_ON_ONE(), although never reported so far. To fix it, teach vm_normal_page_pmd()/vm_normal_page_pud() to consider whether pmd_special/pud_special is actually implemented. The Linux kernel CVE team has assigned CVE-2026-64181 to this issue. Affected and fixed versions =========================== Issue introduced in 6.18 with commit af38538801c6a97565b44700ee6695d7d60ad779 and fixed in 6.18.34 with commit 62153767e8fc3889bc6508e9ffe927aaf64c4334 Issue introduced in 6.18 with commit af38538801c6a97565b44700ee6695d7d60ad779 and fixed in 7.0.11 with commit 9052ea2ee2233be5d4786b8909151ca2bfbedf99 Issue introduced in 6.18 with commit af38538801c6a97565b44700ee6695d7d60ad779 and fixed in 7.1 with commit c0c6ccd9828c3a1950623b546fa57292a77b5c73 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64181 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: mm/memory.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/62153767e8fc3889bc6508e9ffe927aaf64c4334 https://git.kernel.org/stable/c/9052ea2ee2233be5d4786b8909151ca2bfbedf99 https://git.kernel.org/stable/c/c0c6ccd9828c3a1950623b546fa57292a77b5c73