Linux kernel mm/filemap: page cache folio can be stored at the wrong index after an allocation retry

Impact

In the split-a-conflict loop of __filemap_add_folio(), xas_set_order() rounds xa_index down at each stage. If a GFP_NOWAIT node allocation fails the lock is dropped and the sequence retried, but the index is not restored - so if another thread resolved the conflict meanwhile, the folio can be stored in the xarray at an intermediate, rounded-down index. The reporter saw this in production as rare SIGILLs and SIGSEGVs with executable text found a page away from where it belonged. On a busy GPU node this is silent memory corruption of file-backed data under memory pressure: jobs die with inexplicable faults, and served content can be wrong rather than merely unavailable.

Who can reach it

No attacker required - this triggers under ordinary memory pressure with large-folio page cache activity. Any workload on the node can provoke the conditions; it is not a remote or cross-tenant exploit primitive, it is a corruption bug that surfaces as unreliable execution.

What to do

Apply the patched kernel from the linked stable commits (an xas_set_order() restoring the original index at the bottom of the loop) and reboot each node. No configuration mitigation is given in the record; the symptoms stopped for the reporter only once the patch was in.

References

Related entries

• Linux kernel IMA: truncation does not invalidate cached measurements, leaving stale appraisal stateCVE-2026-74592 · Linux kernel IMA (missing file_truncate / path_truncate LSM hooks)Unscored
• Linux kernel sched_ext: lock inversion between scx_cgroup_lock and cgroup_mutex deadlocks the nodeCVE-2026-74593 · Linux kernel sched_ext (scx_cgroup_lock ordering against cgroup_mutex)Unscored
• Linux kernel PSI: rtpoll timer can outlive its cgroup and fire on freed memoryCVE-2026-74594 · Linux kernel sched/psi (rtpoll_timer lifetime vs psi_cgroup_free)Unscored
• Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the hostCVE-2026-74600 · Linux kernel mm/page_table_check (zero-page and huge-zero PMD accounting)Unscored
• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored
• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored