CVE-2018-18281: High severity Linux Linux kernel vulnerability
Last updated 4 July 2026
Other sources
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused.
References:
https://seclists.org/oss-sec/2018/q4/108
https://bugs.chromium.org/p/project-zero/issues/detail?id=1695
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821
— Red Hat
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.9.135 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.14.78 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.18.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.19
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18281?
CVE-2018-18281 has been classified as high severity due to the potential for stale TLB entries leading to memory corruption.
How do I fix CVE-2018-18281?
To resolve CVE-2018-18281, update the Linux kernel to version 5.10.223-1 or later.
Which Linux kernel versions are affected by CVE-2018-18281?
CVE-2018-18281 affects Linux kernel versions from 3.2 up to 4.19.
Is CVE-2018-18281 present in Ubuntu releases?
Yes, CVE-2018-18281 is present in several Ubuntu releases including 12.04, 14.04, 16.04, 18.04, and 18.10.
Does CVE-2018-18281 affect Android devices?
Yes, CVE-2018-18281 affects Android devices running on vulnerable versions of the Linux kernel.