Linux kernel hugetlbfs: fallocate hole-punch races page migration and corrupts page accounting

Impact

remove_inode_single_folio() checked whether a hugetlb folio was still mapped without holding the folio lock. If migration converted the mapping to a migration entry at that moment, folio_mapped() returned false, the folio was never unmapped, migration was then forced to restore the mapping, and the page cache removal hit a BUG in filemap_unaccount_folio(). On GPU nodes this path is live traffic, not an edge case: hugetlbfs backs pinned host buffers for training jobs and DPDK/RDMA-style data paths, and NUMA balancing or compaction supplies the racing migration. The observed outcome is a kernel BUG and corrupted page accounting on a node that holds other tenants' jobs, so a crash costs the whole box, not one container.

Who can reach it

Local, authenticated: any user or tenant process that can fallocate a hole in a hugetlbfs file it owns, while the kernel concurrently migrates those huge pages. No special capability is named in the record; it needs hugetlbfs to be mounted and usable by the workload.

What to do

Pick up the stable kernel containing the fix that takes the folio lock before the mapped check (commits listed in the record) and reboot each affected node. There is no runtime mitigation short of denying workloads hugetlbfs access, which most training and HPC jobs will not tolerate. Plan this as a rolling drain-and-reboot across the fleet.

References

Related entries

• Linux kernel (net/smc): SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out ofCVE-2025-40012 · Linux kernel (net/smc)High
• Linux kernel vhost: missing task reference lets vhost_task_wake() touch a freed task_structCVE-2025-40024 · Linux kernel vhost (struct vhost_task task_struct reference counting)High
• Linux kernel io_uring: waitid entry left on the wait queue races the callback on cancellationCVE-2025-40047 · Linux kernel io_uring waitid (io_waitid_wait wait-queue entry pruning)High
• Linux kernel vhost vringh: copy helper return values checked for negative instead of short copiesCVE-2025-40051 · Linux kernel vhost vringh (copy_from_iter/copy_to_iter return value check)High
• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
• Linux kernel arm_spe: integer overflow in PERF_IDX2OFF with AUX buffers of 2 GiB or moreCVE-2025-40081 · Linux kernel perf arm_spe (PERF_IDX2OFF integer overflow)High