CVE-2026-31575

Vulnerability

Details

In the Linux kernel's userfaultfd implementation for hugetlb pages, the function mfill_atomic_hugetlb() incorrectly uses linear_page_index() to calculate the page index for hugetlb_fault_mutex_hash(). While linear_page_index() returns an index in PAGE_SIZE units, the mutex hash function expects the index in huge page units. This mismatch causes different addresses within the same huge page to map to different mutexes, breaking mutual exclusion for concurrent fault handling on the same huge page [1].

Exploitation

An attacker with the ability to use userfaultfd on hugetlb mappings can trigger this race condition by initiating simultaneous page faults on different offsets within the same huge page. No special privileges beyond local user access are required, as userfaultfd is accessible to unprivileged users in many configurations. The vulnerability is triggered during the userfaultfd page-filling path.

Impact

The race condition can corrupt the hugetlb reservation map, leading to a kernel BUG_ON in resv_map_release(). This results in a denial of service (system crash). There is no evidence of privilege escalation or data corruption beyond the kernel panic.

Mitigation

The fix introduces a new helper function hugetlb_linear_page_index() that returns the page index in huge page granularity, and replaces the incorrect call in mfill_atomic_hugetlb(). The patch has been applied to multiple stable kernel branches [1]. Users should update to the latest patched kernel version.