In the Linux kernel, the following vulnerability has been resolved:
mm: hugetlb: fix UAF in hugetlb_handle_userfault
The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race,
hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */
Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue.
[1] https://lore.kernel.org/linux-mm/[email protected]/ [2] https://lore.kernel.org/linux-mm/[email protected]/
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernelUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.75-48.135Upgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Dec 9, 2025 | Dec 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 8, 2025 |
| Ubuntu | — | Upgrade linuxUpgrade linux-lowlatency-hwe-5.15Upgrade linux-raspiUpgrade linux-riscv-5.15Upgrade linux-azure-fdeUpgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-aws-5.15Upgrade linux-intel-iotgUpgrade linux-realtimeUpgrade linux-bluefieldUpgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-gkeopUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-awsUpgrade linux-gcpUpgrade linux-azure-5.15Upgrade linux-azureUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-gcp-5.15 | Dec 10, 2025 | Dec 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub