Linux kernel hugetlb: fork() corrupts migration and hwpoison swap entries by clearing uffd-wp at the wrong bit

UnscoredCVE-2026-80893Kernel, userspace & hypervisorcurated

Impact

copy_hugetlb_page_range() clears the uffd-wp bit at the present-PTE bit position even for non-present entries, but swap entries carry uffd-wp elsewhere; on x86-64 the cleared bit lands inside the inverted swap offset, so the encoded PFN of a hugetlb migration or hwpoison entry advances by two pages. No userfaultfd has to be involved - a plain fork() while a hugetlb page is under migration, or after that page was poisoned, corrupts the entry the child inherits. The damage is mostly latent because rmap rebuilds the PTE from the folio when migration finishes, but any path that re-encodes the corrupted offset, such as hugetlb_change_protection() rewriting a writable migration entry, propagates the skew. GPU nodes are where this is most likely to be hit: hugetlb is standard for large-page pinning under GPUDirect and DPDK-style data paths, hugetlb pages get migrated under memory pressure, and forking is ubiquitous - the failure mode is silent memory corruption rather than a clean crash.

Who can reach it

Local and unprivileged: any process with access to hugetlb pages that forks while one of those pages is being migrated or has been marked poisoned. No capability, no userfaultfd registration and no authentication beyond normal access to the node - on a shared GPU node that is any tenant able to use hugepages.

What to do

Take a stable kernel containing the mm/hugetlb fix (commits 2b9a0700, 2fa11c60, 69cb5825, 83abe2fd, 8b0de700) and reboot each node; the record names no fixed release number, so match against your vendor's kernel changelog. There is no runtime mitigation short of not using hugetlb pages, which is not realistic on most GPU nodes, so this rides on the next kernel maintenance window.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80893 https://git.kernel.org/stable/c/2b9a07002c2f296aa6a9c591213933d3492e3089 https://git.kernel.org/stable/c/2fa11c60c9c06bafc19cf4d9efdaa36a38079e87 https://git.kernel.org/stable/c/69cb5825d9988c7944bc9f1dc08cb233655405a7

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.