CVE-2026-80893 (GCVE-0-2026-80893)
Vulnerability from cvelistv5 – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11
VLAI
EPSS
VEX
Title
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
copy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison
entries with huge_pte_clear_uffd_wp(), which operates on the present-PTE
bit position. Swap entries keep the uffd-wp state elsewhere -- the
migration branch reads and sets it with pte_swp_uffd_wp() and
pte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap
payload. On x86-64 it lands in the inverted swap offset, where a
naturally-aligned hugetlb PFN always has the affected bit set, so the
clear advances the encoded PFN by two pages.
No userfaultfd needs to be involved: the clear is guarded only by the
child VMA not being uffd-wp registered, so a plain fork() with an
in-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts
the entry copied into the child. Instrumenting the clear and forking
after MADV_HWPOISON on a 2MB anon hugetlb page shows:
offset before=120e00
offset after =120e02
The fallout is mostly latent: rmap walks match migration entries by folio
range and remove_migration_pte() rebuilds the PTE from the folio, so a
within-folio PFN skew heals once migration completes. But any path that
re-encodes the corrupted offset -- e.g. hugetlb_change_protection()
rewriting a writable migration entry via
make_readable_migration_entry(swp_offset(entry)) -- propagates it.
Migration entries legitimately carry uffd-wp, so clear it with
pte_swp_clear_uffd_wp(), matching copy_nonpresent_pte() and
move_huge_pte().
A hwpoison entry, on the other hand, never carries the uffd-wp bit: it is
installed fresh by make_hwpoison_entry() (try_to_unmap_one() does not
preserve uffd-wp on the hwpoison path) and hugetlb_change_protection()
leaves hwpoison entries untouched. There was nothing to clear there, only
the corruption, so drop the clear entirely.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < f1b1311c0352873137768bac5a126e491271a747
(git)
Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 69cb5825d9988c7944bc9f1dc08cb233655405a7 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 8b0de7005b148738d79d6c45594d566489948a68 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 2b9a07002c2f296aa6a9c591213933d3492e3089 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 2fa11c60c9c06bafc19cf4d9efdaa36a38079e87 (git) Affected: bc70fbf269fdff410b0b6d75c3770b9f59117b90 , < 83abe2fd5b3aeb3123b5408a5a91709c5538fb23 (git) |
guessed | |
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1b1311c0352873137768bac5a126e491271a747",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "69cb5825d9988c7944bc9f1dc08cb233655405a7",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "8b0de7005b148738d79d6c45594d566489948a68",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "2b9a07002c2f296aa6a9c591213933d3492e3089",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "2fa11c60c9c06bafc19cf4d9efdaa36a38079e87",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
},
{
"lessThan": "83abe2fd5b3aeb3123b5408a5a91709c5538fb23",
"status": "affected",
"version": "bc70fbf269fdff410b0b6d75c3770b9f59117b90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()\n\ncopy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison\nentries with huge_pte_clear_uffd_wp(), which operates on the present-PTE\nbit position. Swap entries keep the uffd-wp state elsewhere -- the\nmigration branch reads and sets it with pte_swp_uffd_wp() and\npte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap\npayload. On x86-64 it lands in the inverted swap offset, where a\nnaturally-aligned hugetlb PFN always has the affected bit set, so the\nclear advances the encoded PFN by two pages.\n\nNo userfaultfd needs to be involved: the clear is guarded only by the\nchild VMA not being uffd-wp registered, so a plain fork() with an\nin-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts\nthe entry copied into the child. Instrumenting the clear and forking\nafter MADV_HWPOISON on a 2MB anon hugetlb page shows:\n\n offset before=120e00\n offset after =120e02\n\nThe fallout is mostly latent: rmap walks match migration entries by folio\nrange and remove_migration_pte() rebuilds the PTE from the folio, so a\nwithin-folio PFN skew heals once migration completes. But any path that\nre-encodes the corrupted offset -- e.g. hugetlb_change_protection()\nrewriting a writable migration entry via\nmake_readable_migration_entry(swp_offset(entry)) -- propagates it.\n\nMigration entries legitimately carry uffd-wp, so clear it with\npte_swp_clear_uffd_wp(), matching copy_nonpresent_pte() and\nmove_huge_pte().\n\nA hwpoison entry, on the other hand, never carries the uffd-wp bit: it is\ninstalled fresh by make_hwpoison_entry() (try_to_unmap_one() does not\npreserve uffd-wp on the hwpoison path) and hugetlb_change_protection()\nleaves hwpoison entries untouched. There was nothing to clear there, only\nthe corruption, so drop the clear entirely."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:09.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1b1311c0352873137768bac5a126e491271a747"
},
{
"url": "https://git.kernel.org/stable/c/69cb5825d9988c7944bc9f1dc08cb233655405a7"
},
{
"url": "https://git.kernel.org/stable/c/8b0de7005b148738d79d6c45594d566489948a68"
},
{
"url": "https://git.kernel.org/stable/c/2b9a07002c2f296aa6a9c591213933d3492e3089"
},
{
"url": "https://git.kernel.org/stable/c/2fa11c60c9c06bafc19cf4d9efdaa36a38079e87"
},
{
"url": "https://git.kernel.org/stable/c/83abe2fd5b3aeb3123b5408a5a91709c5538fb23"
}
],
"title": "mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80893",
"datePublished": "2026-09-04T17:11:09.199Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-09-04T17:11:09.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80893\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-04T18:17:57.467\",\"lastModified\":\"2026-09-04T18:17:57.467\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()\\n\\ncopy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison\\nentries with huge_pte_clear_uffd_wp(), which operates on the present-PTE\\nbit position. Swap entries keep the uffd-wp state elsewhere -- the\\nmigration branch reads and sets it with pte_swp_uffd_wp() and\\npte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap\\npayload. On x86-64 it lands in the inverted swap offset, where a\\nnaturally-aligned hugetlb PFN always has the affected bit set, so the\\nclear advances the encoded PFN by two pages.\\n\\nNo userfaultfd needs to be involved: the clear is guarded only by the\\nchild VMA not being uffd-wp registered, so a plain fork() with an\\nin-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts\\nthe entry copied into the child. Instrumenting the clear and forking\\nafter MADV_HWPOISON on a 2MB anon hugetlb page shows:\\n\\n offset before=120e00\\n offset after =120e02\\n\\nThe fallout is mostly latent: rmap walks match migration entries by folio\\nrange and remove_migration_pte() rebuilds the PTE from the folio, so a\\nwithin-folio PFN skew heals once migration completes. But any path that\\nre-encodes the corrupted offset -- e.g. hugetlb_change_protection()\\nrewriting a writable migration entry via\\nmake_readable_migration_entry(swp_offset(entry)) -- propagates it.\\n\\nMigration entries legitimately carry uffd-wp, so clear it with\\npte_swp_clear_uffd_wp(), matching copy_nonpresent_pte() and\\nmove_huge_pte().\\n\\nA hwpoison entry, on the other hand, never carries the uffd-wp bit: it is\\ninstalled fresh by make_hwpoison_entry() (try_to_unmap_one() does not\\npreserve uffd-wp on the hwpoison path) and hugetlb_change_protection()\\nleaves hwpoison entries untouched. There was nothing to clear there, only\\nthe corruption, so drop the clear entirely.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"f1b1311c0352873137768bac5a126e491271a747\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"69cb5825d9988c7944bc9f1dc08cb233655405a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"8b0de7005b148738d79d6c45594d566489948a68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"2b9a07002c2f296aa6a9c591213933d3492e3089\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"2fa11c60c9c06bafc19cf4d9efdaa36a38079e87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc70fbf269fdff410b0b6d75c3770b9f59117b90\",\"lessThan\":\"83abe2fd5b3aeb3123b5408a5a91709c5538fb23\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/hugetlb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b9a07002c2f296aa6a9c591213933d3492e3089\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2fa11c60c9c06bafc19cf4d9efdaa36a38079e87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69cb5825d9988c7944bc9f1dc08cb233655405a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83abe2fd5b3aeb3123b5408a5a91709c5538fb23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b0de7005b148738d79d6c45594d566489948a68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1b1311c0352873137768bac5a126e491271a747\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"suse_vex": {
"aggregate_severity": "not set",
"current_release_date": "2026-09-05T00:25:07Z",
"cve": "CVE-2026-80893",
"id": "CVE-2026-80893",
"initial_release_date": "2026-09-05T00:25:07Z",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-80893",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80893.json",
"version": "2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…