CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put()
In the Linux kernel, the following vulnerability has been resolved:
mm/hugememory: update file PMD counter before folioput()
splithugepmdlocked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folioput() drops the last reference, mmcounterfile() can later read freed folio state via foliotestswapbacked().
Move the counter update before folioput().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix described for mm/huge_memory: update the file/shmem RSS counter before calling folio_put() in __split_huge_pmd_locked(), so mm_counter_file() cannot later read freed folio state via folio_test_swapbacked().
Linux kernel (mm/huge_memory: file PMD counter) Update file/shmem RSS counter before dropping the PMD mapping folio reference = Move counter update before folio_put()
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
What is the potential impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as high. The flaw involves accessing freed folio state during huge PMD splitting.
How can I determine whether a fix is available for my kernel?
Check whether your kernel's stable source includes one of the referenced fixes: 108963978a681c0c468d279cac2b930c27672877, 459771c9cf30f378bdbd30fc65d17f7eb931bb59, or 5f5b604e1e6bde4e889199168ee80fe8306d06ad. The provided data does not map these commits to kernel release versions.