Linux kernel mm/filemap: nr_pages overflow in fault-around maps past the end of a large folio

Impact

A race between filemap_map_pages() holding a folio with a stale inode->i_size and a concurrent truncate (ext4_setattr) lets nr_pages overflow, so set_pte_range() installs PTEs beyond the large folio's size. That corrupts page fields - page->_mapcount among them - on pages that do not belong to the folio, which surfaces later as "Bad page state" and nonzero-mapcount splats far from the original fault. The reporter hit it with stress-ng on arm64 on 7.0-rc3. Cross-folio page metadata corruption on a host kernel is a privilege escalation candidate and, more commonly, an unexplained crash on a node that then has to be drained and rebooted. It is reachable from ordinary file-backed mmap plus truncate, so any tenant with a writable filesystem can drive the pattern.

Who can reach it

Local, unprivileged: a process that mmaps a file-backed large folio and races a truncate on the same file. No capability required; both halves are standard syscalls available inside a container with a writable mount.

What to do

Update the host kernel to a build carrying the stable fix commits below and reboot each node. No mitigation short of patching is identified in the record - the overflow is in the fault-around path that ordinary file mappings use.

References

Related entries

• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-31656 · Linux i915 GPU kernel driverHigh
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High
• Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_ENDCVE-2026-43030 · Linux kernel BPF verifier (regsafe() packet pointer range comparison)High