Linux mm: file-backed THP split reads folio state after dropping the last reference

Impact

When a file or shmem PMD mapping is split, the kernel updates the RSS counter after releasing the folio reference. If that release frees the folio, mm_counter_file() then reads folio_test_swapbacked() out of freed memory. Any local process that can map a file or shmem huge page and force a PMD split exercises this path, and THP on shmem is the normal configuration on GPU nodes that use large hugepage-backed staging buffers or /dev/shm for inter-process tensor handoff. The record gives no exploitation detail beyond the read of freed state; treat it as kernel memory corruption of unproven reliability rather than a known escape. Scored 7.8 local by NVD.

Who can reach it

Local unprivileged user or any container able to create file/shmem-backed transparent huge pages and trigger a PMD split. No network path.

What to do

Update to a stable kernel that moves the counter update before folio_put(); the fix is a one-line reordering in core mm, so distro kernels will carry it in a routine update. Core mm cannot be mitigated by configuration short of disabling file/shmem THP, which costs performance on GPU nodes. Rolling it out means drain and reboot each node.

References

Related entries

• Linux io_uring: bundle recv drops IORING_CQE_F_BUF_MORE, so userspace advances past a buffer the kernel still usesCVE-2026-53191 · Linux kernel io_uring/net (bundle recv, IORING_CQE_F_BUF_MORE inheritance)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGESCVE-2026-53362 · Linux kernel IPv6 (__ip6_append_data paged allocation path)High
• Linux FUSE: request not re-locked before page cache folio replacement, giving a use-after-freeCVE-2026-53388 · Linux kernel FUSE (fuse_try_move_folio page cache replacement)High
• libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary filesCVE-2026-63622 · libvirt (virFileChownFiles over the swtpm state directory)High
• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High