In the Linux kernel, the following vulnerability has been resolved:
mm: hugetlb: independent PMD page table shared count
The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked:
BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198
The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table.
1. The page table itself will be discarded after reporting the "nonzero mapcount".
2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped.
Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.186-128.192Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.239-236.958 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-livepatch-6.1.144-170.251Upgrade perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-debuginfoUpgrade kernel-modules-extra-commonUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade kernel-toolsUpgrade kernel-devel | Jul 30, 2025 | Jan 15, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 15, 2025 | Jan 15, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools | May 13, 2025 | Jan 15, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Apr 11, 2025 | Jan 15, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | May 7, 2025 | Jan 15, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel | Apr 1, 2025 | Jan 15, 2025 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Mar 18, 2025 | Jan 15, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jan 15, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 15, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-lts-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-1034-nvidia-tegra-igx-rtUpgrade linux-image-generic-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-fipsUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-5.15Upgrade linux-image-5.15.0-1090-oracleUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-5.15.0-1089-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1029-awsUpgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-5.15Upgrade linux-image-6.11.0-1011-awsUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1056-xilinx-zynqmpUpgrade linux-image-5.15.0-1087-nvidiaUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-raspiUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.15.0-1092-aws-64kUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-aws-5.15Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-6.8Upgrade linux-image-intelUpgrade linux-image-ibmUpgrade linux-image-oem-24.04bUpgrade linux-image-5.15.0-1092-gcp-fipsUpgrade linux-image-5.15.0-1092-awsUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1045-nvidia-tegra-rtUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-6.8.0-1028-oemUpgrade linux-image-5.15.0-1045-nvidia-tegraUpgrade linux-image-5.15.0-1096-azureUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-aws-fips-5.15Upgrade linux-image-genericUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-5.15.0-1087-nvidia-lowlatencyUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1029-azureUpgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-kvm-5.15Upgrade linux-image-fipsUpgrade linux-image-generic-64k-5.15Upgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-1075-gkeopUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-azure-fips-5.15Upgrade linux-image-oem-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-gkeopUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-nvidiaUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1087-intel-iotgUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-60-genericUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-5.15.0-1092-aws-fipsUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-5.15.0-1086-ibmUpgrade linux-image-realtime-5.15Upgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-5.15.0-156-generic-lpaeUpgrade linux-image-5.15.0-156-genericUpgrade linux-image-virtual-5.15Upgrade linux-image-5.15.0-156-lowlatency-64kUpgrade linux-image-5.15.0-1092-realtimeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-64k-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-oracleUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-156-generic-64kUpgrade linux-image-azure-cvmUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-5.15.0-156-lowlatencyUpgrade linux-image-5.15.0-1092-gcpUpgrade linux-image-5.15.0-1085-intel-iot-realtimeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-5.15Upgrade linux-image-oem-24.04aUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-5.15.0-1096-azure-fipsUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-fips-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-raspi-5.15Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-5.15Upgrade linux-image-5.15.0-1088-kvmUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-5.15.0-156-fipsUpgrade linux-image-oem-22.04dUpgrade linux-image-raspi-realtimeUpgrade linux-image-5.15.0-1086-raspiUpgrade linux-image-5.15.0-1034-nvidia-tegra-igxUpgrade linux-image-oracle-5.15Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-22.04b | Mar 28, 2025 | Jan 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Jan 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub