CVE-2026-31397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31397", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.085Z", "datePublished": "2026-04-03T15:16:01.427Z", "dateUpdated": "2026-08-05T12:22:06.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:06.974Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()\n\nmove_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge\nzero pages. For the huge zero page path, src_folio is explicitly set to\nNULL, and is used as a sentinel to skip folio operations like lock and\nrmap.\n\nIn the huge zero page branch, src_folio is NULL, so folio_mk_pmd(NULL,\npgprot) passes NULL through folio_pfn() and page_to_pfn(). With\nSPARSEMEM_VMEMMAP this silently produces a bogus PFN, installing a PMD\npointing to non-existent physical memory. On other memory models it is a\nNULL dereference.\n\nUse page_folio(src_page) to obtain the valid huge zero folio from the\npage, which was obtained from pmd_page() and remains valid throughout.\n\nAfter commit d82d09e48219 (\"mm/huge_memory: mark PMD mappings of the huge\nzero folio special\"), moved huge zero PMDs must remain special so\nvm_normal_page_pmd() continues to treat them as special mappings.\n\nmove_pages_huge_pmd() currently reconstructs the destination PMD in the\nhuge zero page branch, which drops PMD state such as pmd_special() on\narchitectures with CONFIG_ARCH_HAS_PTE_SPECIAL. As a result,\nvm_normal_page_pmd() can treat the moved huge zero PMD as a normal page\nand corrupt its refcount.\n\nInstead of reconstructing the PMD from the folio, derive the destination\nentry from src_pmdval after pmdp_huge_clear_flush(), then handle the PMD\nmetadata the same way move_huge_pmd() does for moved entries by marking it\nsoft-dirty and clearing uffd-wp."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local `userfaultfd` ioctls, specifically `UFFDIO_MOVE`, on the attacker's own address space.\nAC:L - An attacker can create aligned anonymous VMAs, materialize a huge zero PMD with reads, register the destination with userfaultfd, and issue `UFFDIO_MOVE`; no uncontrollable race is required.\nPR:L - A basic unprivileged local user can create a userspace-only userfaultfd with `UFFD_USER_MODE_ONLY` and exercise `UFFDIO_MOVE` on their own memory.\nUI:N - Exploitation is driven entirely by the attacker's own syscalls and memory accesses and does not require a victim user action.\nS:U - The impact is within the local kernel and the attacking process's memory-management context, with no separate security authority crossed.\nC:H - The bug can install a malformed huge PMD and the fix notes refcount corruption when huge zero PMDs lose special state; treating this as kernel memory corruption makes high confidentiality impact defensible.\nI:H - The malformed PMD/refcount corruption affects kernel-managed memory structures and can plausibly be developed beyond a crash into memory modification or control-flow compromise.\nA:H - On some memory models this is a direct NULL dereference, and on common sparse-vmemmap systems it installs a bogus PMD that can crash the kernel during access or later VM teardown."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/huge_memory.c"], "versions": [{"version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "lessThan": "f3caaee0f9e489fd2282d4ce45791dc8aed2da62", "status": "affected", "versionType": "git"}, {"version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "lessThan": "e3133d0986dc5a231d5419167dbac65312b28b41", "status": "affected", "versionType": "git"}, {"version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "lessThan": "fae654083bfa409bb2244f390232e2be47f05bfc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/huge_memory.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f3caaee0f9e489fd2282d4ce45791dc8aed2da62"}, {"url": "https://git.kernel.org/stable/c/e3133d0986dc5a231d5419167dbac65312b28b41"}, {"url": "https://git.kernel.org/stable/c/fae654083bfa409bb2244f390232e2be47f05bfc"}], "title": "mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/huge_memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f3caaee0f9e489fd2282d4ce45791dc8aed2da62", "status": "affected", "version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "versionType": "git"}, {"lessThan": "e3133d0986dc5a231d5419167dbac65312b28b41", "status": "affected", "version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "versionType": "git"}, {"lessThan": "fae654083bfa409bb2244f390232e2be47f05bfc", "status": "affected", "version": "e3981db444a0a18d350d9f92e3f2e8d489b54211", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/huge_memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C570CE1-BC61-4BE6-9393-FD0CA8637367", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()\n\nmove_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge\nzero pages. For the huge zero page path, src_folio is explicitly set to\nNULL, and is used as a sentinel to skip folio operations like lock and\nrmap.\n\nIn the huge zero page branch, src_folio is NULL, so folio_mk_pmd(NULL,\npgprot) passes NULL through folio_pfn() and page_to_pfn(). With\nSPARSEMEM_VMEMMAP this silently produces a bogus PFN, installing a PMD\npointing to non-existent physical memory. On other memory models it is a\nNULL dereference.\n\nUse page_folio(src_page) to obtain the valid huge zero folio from the\npage, which was obtained from pmd_page() and remains valid throughout.\n\nAfter commit d82d09e48219 (\"mm/huge_memory: mark PMD mappings of the huge\nzero folio special\"), moved huge zero PMDs must remain special so\nvm_normal_page_pmd() continues to treat them as special mappings.\n\nmove_pages_huge_pmd() currently reconstructs the destination PMD in the\nhuge zero page branch, which drops PMD state such as pmd_special() on\narchitectures with CONFIG_ARCH_HAS_PTE_SPECIAL. As a result,\nvm_normal_page_pmd() can treat the moved huge zero PMD as a normal page\nand corrupt its refcount.\n\nInstead of reconstructing the PMD from the folio, derive the destination\nentry from src_pmdval after pmdp_huge_clear_flush(), then handle the PMD\nmetadata the same way move_huge_pmd() does for moved entries by marking it\nsoft-dirty and clearing uffd-wp."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/huge_memory: corrige el uso de folio NULL en move_pages_huge_pmd()\n\nmove_pages_huge_pmd() maneja UFFDIO_MOVE tanto para THPs normales como para p\u00e1ginas cero enormes. Para la ruta de la p\u00e1gina cero enorme, src_folio se establece expl\u00edcitamente en NULL, y se usa como un centinela para omitir operaciones de folio como lock y rmap.\n\nEn la rama de la p\u00e1gina cero enorme, src_folio es NULL, por lo que folio_mk_pmd(NULL, pgprot) pasa NULL a trav\u00e9s de folio_pfn() y page_to_pfn(). Con SPARSEMEM_VMEMMAP esto produce silenciosamente un PFN err\u00f3neo, instalando un PMD que apunta a memoria f\u00edsica inexistente. En otros modelos de memoria es una desreferencia NULL.\n\nUsar page_folio(src_page) para obtener el folio cero enorme v\u00e1lido de la p\u00e1gina, que se obtuvo de pmd_page() y permanece v\u00e1lido en todo momento.\n\nDespu\u00e9s del commit d82d09e48219 ('mm/huge_memory: marcar las asignaciones PMD del folio cero enorme como especiales'), los PMD cero enormes movidos deben permanecer especiales para que vm_normal_page_pmd() contin\u00fae trat\u00e1ndolos como asignaciones especiales.\n\nmove_pages_huge_pmd() actualmente reconstruye el PMD de destino en la rama de la p\u00e1gina cero enorme, lo que elimina el estado del PMD como pmd_special() en arquitecturas con CONFIG_ARCH_HAS_PTE_SPECIAL. Como resultado, vm_normal_page_pmd() puede tratar el PMD cero enorme movido como una p\u00e1gina normal y corromper su refcount.\n\nEn lugar de reconstruir el PMD a partir del folio, derivar la entrada de destino de src_pmdval despu\u00e9s de pmdp_huge_clear_flush(), luego manejar los metadatos del PMD de la misma manera que move_huge_pmd() lo hace para las entradas movidas, marc\u00e1ndolo como soft-dirty y borrando uffd-wp."}], "id": "CVE-2026-31397", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-03T16:16:38.093", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3133d0986dc5a231d5419167dbac65312b28b41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f3caaee0f9e489fd2282d4ce45791dc8aed2da62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fae654083bfa409bb2244f390232e2be47f05bfc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()", "id": "2454854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454854"}, "csaw": false, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's memory management subsystem, specifically within the `move_pages_huge_pmd()` function. A local user could exploit a NULL pointer dereference when handling huge zero pages, which can lead to a system crash and a Denial of Service (DoS). Furthermore, improper reconstruction of Page Middle Directory (PMD) entries can cause memory corruption by incorrectly treating special memory mappings as normal pages, potentially leading to system instability."], "name": "CVE-2026-31397", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31397\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31397\nhttps://lore.kernel.org/linux-cve-announce/2026040326-CVE-2026-31397-8672@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3981db444a0a18d350d9f92e3f2e8d489b54211,f3caaee0f9e489fd2282d4ce45791dc8aed2da62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3981db444a0a18d350d9f92e3f2e8d489b54211,e3133d0986dc5a231d5419167dbac65312b28b41)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e3981db444a0a18d350d9f92e3f2e8d489b54211,fae654083bfa409bb2244f390232e2be47f05bfc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.20,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.10,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T16:35:50.373581+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that incorporates commit d82d09e48219 or later, which fixes the NULL folio handling in move_pages_huge_pmd.", "Recompile any custom kernel modules or drivers against the updated kernel headers to prevent mismatches that could re\u2011introduce the issue.", "After applying the update, reboot the system to ensure all memory mappings are rebuilt and legacy references are cleared."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Linux kernels that contain the buggy move_pages_huge_pmd implementation are affected. The exact affected release series is not listed in the advisory, so any kernel version prior to the commit that introduces this fix is potentially vulnerable.", "description_and_impact": "The move_pages_huge_pmd function in the Linux kernel mishandles a NULL folio when moving huge zero pages. This bug causes a bogus page frame number to be written into a PMD entry, pointing to non\u2011existent memory or causing a NULL dereference. An attacker who can invoke the UFFDIO_MOVE ioctl can trigger a kernel crash or memory corruption, resulting in a denial of service and potential corruption of data used by other processes.", "risk_and_exploitability": "The CVSS score is 7.8 and the EPSS score is <1%, indicating a high severity but low exploitation probability. However, the vulnerability involves a kernel memory corruption scenario that can be triggered via a privileged ioctl. In environments where an attacker can reach kernel space\u2014such as a local privileged user or a compromised device\u2014the risk of a crash or data corruption is high. The vulnerability is not currently listed in CISA\u2019s KEV catalog, indicating no publicly known active exploitation at this time."}}}}, "created": "2026-04-03T21:13:16.272125+00:00", "updated": "2026-04-28T16:45:06.166176+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}