Linux kernel mm: snapshot_page() reads a non-existent tail page for order-1 folios and oopses the host

Impact

snapshot_page() guarded its read of __page_2 with nr_pages > 1 instead of nr_pages > 2, so an order-1 folio sitting at the end of a vmemmap section makes the kernel dereference struct-page memory that was never mapped. The reported trigger was a DLPAR memory hot-remove on a 22 TB ppc64le LPAR, where the page isolation path oopsed against an adjacent absent section. This is a host kernel crash, not a privilege boundary break - the record shows no path to code execution. On a GPU node the consequence is the expensive one: an oops in the memory-management path takes the node and every tenant workload pinned to its GPUs down at once, and recovery is a reboot rather than a service restart.

Who can reach it

Local, and only from code that can reach the page-snapshot path with an order-1 folio adjacent to a vmemmap hole; the record scores it as requiring low privileges. The only concretely documented trigger is memory hot-remove on a machine with unmapped vmemmap sections. Whether an unprivileged tenant can reach it on a conventional x86_64 GPU node without memory hotplug is not established by the record.

What to do

Update to a stable kernel carrying the fix (commits 7441d634, 9668ffe0, c6493245) and reboot the node. No fixed release numbers are given in the record - check the commit against your distribution's kernel changelog. Where memory hot-remove is what triggers it, holding off on DLPAR/hotplug operations avoids the documented path until the reboot window arrives.

References

Related entries

• Linux kernel cxl/ras: RCH AER capability copy reads past the mapped register blockCVE-2026-89731 · Linux kernel CXL RAS (cxl_rch_get_aer_info, RCRB AER register copy)High
• KVM arm64 vgic-its: guest MAPC with V=0 crashes the host when the VMM saves ITS tablesCVE-2026-89912 · Linux kernel KVM arm64 vgic-its (ITT save path)High
• KVM x86 Hyper-V stimer: overflowed deadline livelocks the vCPU thread and stalls RCU on the hostCVE-2026-89927 · Linux kernel KVM x86 Hyper-V synthetic timer (stimer deadline calculation)High
• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• OpenSSH sshd: helper commands inherit sshd's supplemental groups, allowing privilege escalationCVE-2021-41617 · OpenSSH sshd (AuthorizedKeysCommand / AuthorizedPrincipalsCommand helper privileges)High