Linux kernel mm: use-after-free of address_space ops in folio_unmap_invalidate()

Impact

folio_unmap_invalidate() called filemap_free_folio() after it had already removed the folio from its mapping. At that point nothing kept the mapping alive, so it could be freed in a race, and the later read of mapping->a_ops was a use-after-free. This is in the core page-cache code that every host runs. A race that is won can crash the kernel or corrupt memory, which on a GPU node takes down every tenant workload on it. The record does not describe how this can be exploited. The NVD score of 9.8 with a network vector is not supported by the description, which reads as a local race in the invalidation path.

Who can reach it

Local. Needs a process that can drive page-cache invalidation on a file, for example through truncation or uncached and invalidating I/O, while racing mapping teardown. The record does not say whether privilege is needed.

What to do

Install a kernel that contains one of the referenced stable commits, then drain and reboot each node. The record names no mitigation that avoids a reboot.

References

Related entries

• Linux kernel (net/ipv4): A child socket created from an inbound handshake is inserted into the TCP hash table beforeCVE-2026-43198 · Linux kernel (net/ipv4)Critical
• Linux kernel qla2xxx: fcport double free on the ELS DCMD error pathCVE-2026-43414 · Linux kernel scsi qla2xxx (qla24xx_els_dcmd_iocb fcport lifetime)Critical
• Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350CVE-2026-43465 · Linux kernel mlx5_core RX datapath (striding RQ, page_pool)Critical
• Linux kernel pcrypt: EBUSY from backlogged requests is mishandled, corrupting completion accountingCVE-2026-43493 · Linux kernel crypto/pcrypt (MAY_BACKLOG request completion handling)Critical
• Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCVE-2026-46135 · Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error pathsCritical
• Linux kernel libceph: out-of-bounds access parsing a CRUSH map with mismatched bucket algorithm fieldsCVE-2026-52955 · Linux kernel libceph (crush_decode bucket algorithm parsing)Critical