Linux kernel mm/rmap: missing barrier lets a reused anon_vma hang tasks and use-after-free its root

Impact

__anon_vma_prepare() published a freshly allocated anon_vma to vma->anon_vma with a plain store, so on a weakly ordered architecture a second thread could find the anon_vma while still seeing the old root pointer. It then locks one root and unlocks another, leaving an anon_vma locked forever - the reporters saw hung-task splats on an arm64 server with anon_vma->root->rwsem permanently held, plus a use-after-free of anon_vma->root. For an operator the visible failure is processes wedged in page-fault paths that no signal clears, which on a GPU node means a job that holds its allocations while making no progress and a node that only a reboot recovers. Requires two adjacent anon_vma-compatible but unmerged VMAs faulted concurrently; this is a core memory-management path, not GPU-specific, and arm64 hosts are the reported case.

Who can reach it

Local unprivileged process on the host (or inside a container) that can mprotect adjacent mappings and fault them from two threads. No authentication beyond code execution; triggering is a race.

What to do

Upgrade to a stable kernel with the barrier fix for your series (five stable commits listed) and reboot the node; there is no runtime mitigation for a memory-ordering bug in the fault path. Prioritize arm64 hosts, where the reordering is observable. No distro fixed versions appear in the record.

References

Related entries

• Linux kernel rds/ib: stale scatterlist after failed MR registration gives a use-after-free on teardownCVE-2026-98524 · Linux kernel RDS over InfiniBand (rds_ib_map_frmr scatterlist ownership)High
• Linux kernel BPF verifier: missed zero-extension marking lets a loaded program inject arbitrary register upper halvesCVE-2026-98869 · Linux kernel BPF verifier (32-bit subregister zero-extension / zext_dst inference)High
• drm/vmwgfx: unvalidated pitch in cursor snooping allows out-of-bounds reads in a VMware guestCVE-2026-99002 · Linux kernel drm/vmwgfx (cursor snooping, unvalidated userspace pitch)High
• Linux net/smc: use-after-free on the CLC socket in smc_getname during link-group terminationCVE-2026-99032 · Linux kernel net/smc (smc_getname clcsock lifetime)High
• KVM SEV: unlocked set_page_dirty on get_user_pages_fast pages during guest memory populationCVE-2026-99177 · Linux kernel KVM SEV (sev_gmem_post_populate guest-memory population)High
• Linux kernel io_uring/waitid: repeated failed cancellations wrap the reference counter and double-complete a requestCVE-2026-99227 · Linux kernel io_uring waitid (31-bit cancel reference counter wrap)High