Linux kernel mm: huge-zero-folio shrinker races a page fault and misidentifies the huge zero page

Impact

The shrinker that releases the huge zero folio can be preempted between zeroing huge_zero_refcount and writing the ~0UL sentinel, so a concurrent fault that allocates a fresh huge zero folio has its valid huge_zero_pfn overwritten afterwards. From that point is_huge_zero_pfn() and is_huge_zero_pmd() return false for the huge zero folio, and the THP code paths treat it as an ordinary folio - it can be split or otherwise handled incorrectly. Any unprivileged process doing THP-backed faults under memory pressure can hit the window, so on a shared GPU node one tenant's allocation pattern can destabilise the host kernel that every other tenant on that node depends on, and a host kernel wedge costs every in-flight training job on it. The record establishes misidentification and improper splitting; it does not establish a privilege-escalation path, and kernels built with CONFIG_PERSISTENT_HUGE_ZERO_FOLIO do not use the refcounted path at all.

Who can reach it

Local. Any tenant with a GPU pod or a shell on the node can drive THP faults while the huge-zero-folio shrinker runs. No capability, device access, or authentication beyond having a process on the machine; not reachable from the network.

What to do

Pick up a stable kernel carrying the first patch of the series (the spinlock around the huge_zero_pfn/folio/refcount writes, which the author kept small specifically so it backports alone), then drain and reboot each node. There is no runtime mitigation - building with CONFIG_PERSISTENT_HUGE_ZERO_FOLIO sidesteps the refcounted path but is itself a rebuild and reboot. The record lists only stable commits, no fixed release numbers.

References

Related entries

• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored
• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored
• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored
• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored
• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored