CVE-2026-46013: mm/memfd_luo: fix physical address conversion in put_folios cleanup
In the Linux kernel, the following vulnerability has been resolved:
mm/memfdluo: fix physical address conversion in putfolios cleanup
In memfdluoretrievefolios()'s putfolios cleanup path:
1. khorestorefolio() expects a physaddrt (physical address) but receives a raw PFN (pfolio->pfn). This causes khorestorepage() to check the wrong physical address (pfn << PAGESHIFT instead of the actual physical address).
2. This loop lacks the !pfolio->pfn check that exists in the main retrieval loop and memfdluodiscardfolios(), which could incorrectly process sparse file holes where pfn=0.
Fix by converting PFN to physical address with PFNPHYS() and adding the !pfolio->pfn check, matching the pattern used elsewhere in this file.
This issue was identified by the AI review. https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Apply the code-level fix in the kernel source: in mm/memfd_luo (memfd_luo_retrieve_folios()) update the put_folios cleanup path to convert the PFN to a physical address using PFN_PHYS(pfolio->pfn) and add the existing !pfolio->pfn check before processing folios (matching the pattern used elsewhere in the file). Rebuild and deploy the updated kernel (or backport the same changes to your maintained kernel tree) so the fix is in effect.