Linux kernel hugetlb: fork() corrupts migration and hwpoison swap entries by clearing uffd-wp at the wrong bit

Impact

copy_hugetlb_page_range() clears the uffd-wp bit at the present-PTE bit position even for non-present entries, but swap entries carry uffd-wp elsewhere; on x86-64 the cleared bit lands inside the inverted swap offset, so the encoded PFN of a hugetlb migration or hwpoison entry advances by two pages. No userfaultfd has to be involved - a plain fork() while a hugetlb page is under migration, or after that page was poisoned, corrupts the entry the child inherits. The damage is mostly latent because rmap rebuilds the PTE from the folio when migration finishes, but any path that re-encodes the corrupted offset, such as hugetlb_change_protection() rewriting a writable migration entry, propagates the skew. GPU nodes are where this is most likely to be hit: hugetlb is standard for large-page pinning under GPUDirect and DPDK-style data paths, hugetlb pages get migrated under memory pressure, and forking is ubiquitous - the failure mode is silent memory corruption rather than a clean crash.

Who can reach it

Local and unprivileged: any process with access to hugetlb pages that forks while one of those pages is being migrated or has been marked poisoned. No capability, no userfaultfd registration and no authentication beyond normal access to the node - on a shared GPU node that is any tenant able to use hugepages.

What to do

Take a stable kernel containing the mm/hugetlb fix (commits 2b9a0700, 2fa11c60, 69cb5825, 83abe2fd, 8b0de700) and reboot each node; the record names no fixed release number, so match against your vendor's kernel changelog. There is no runtime mitigation short of not using hugetlb pages, which is not realistic on most GPU nodes, so this rides on the next kernel maintenance window.

References

Related entries

• Linux kernel iommufd: hwpt replace responds to faults on the wrong domain, stranding faults on the old hwptCVE-2026-80894 · Linux kernel iommufd (fault auto-response on hwpt replace)Unscored
• Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epollCVE-2026-80920 · Linux kernel io_uring (eventfd signaling on DEFER_TASKRUN rings)Unscored
• Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed dataCVE-2026-80945 · Linux kernel crypto/iaa (Intel In-Memory Analytics Accelerator decompress path)Unscored
• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored
• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored
• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored