CVE-2026-64181
Beschrijving NL
In de Linux kernel is de volgende kwetsbaarheid verholpen:
mm: fix __vm_normal_page() om ontbrekende ondersteuning voor pmd_special()/pud_special() te behandelen
Op x86 32-bits met THP ingeschakeld, wordt zap_huge_pmd() gezien om een
"WAARSCHUWING: mm/memory.c:735 op __vm_normal_page+0x6a/0x7d", uit de
VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); gevolgd door
"BUG: Bad rss-counter state"s, dan later "BUG: Bad page state"s wanneer
reclaim mag shrink_huge_zero_folio_sca bellen aant. Het is alsof de _PAGE_SPECIAL bit nooit is ingesteld in de huge_zero pmd: en
inderdaad, terwijl pte_special() en pte_mkspecial() onderworpen zijn aan een
dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() en pmd_mkspecial()
zijn onderworpen aan CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, die nooit is ingeschakeld op
elke 32-bits architectuur. Terwijl het probleem werd blootgelegd via commit d80a9cb1a64a
("mm/huge_memory: toevoegen en gebruiken normal_or_softleaf_folio_pmd()"), het was een
toezicht in commit af38538801c6 ("mm/memory: factor out common code from
vm_normal_page_*()") en zou leiden tot andere problemen:
* enorme zero folio verantwoord in smaps, pagemap (PAGE_IS_FILE) en
numamaps als THP met bestandsondersteuning
* folio_Walk_start() retourneert de folio zelfs zonder FW_ZEROPAGE set. Bellers lijken dat echter te tolereren. ... en het activeren van de VM_WARN_ON_ONE(), hoewel tot nu toe nog nooit gemeld. Om het op te lossen, leer je vm_normal_page_pmd()/vm_normal_page_pud() om te overwegen
of pmd_special/pud_special daadwerkelijk wordt geïmplementeerd.
Origineel (Engels) tonen
In the Linux kernel, the following vulnerability has been resolved:
mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()
On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a
"WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the
VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by
"BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when
reclaim gets to call shrink_huge_zero_folio_scan().
It's as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and
indeed, whereas pte_special() and pte_mkspecial() are subject to a
dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial()
are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on
any 32-bit architecture.
While the problem was exposed through commit d80a9cb1a64a
("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an
oversight in commit af38538801c6 ("mm/memory: factor out common code from
vm_normal_page_*()") and would result in other problems:
* huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and
numamaps as file-backed THP
* folio_walk_start() returning the folio even without FW_ZEROPAGE set.
Callers seem to tolerate that, though.
... and triggering the VM_WARN_ON_ONE(), although never reported so far.
To fix it, teach vm_normal_page_pmd()/vm_normal_page_pud() to consider
whether pmd_special/pud_special is actually implemented.