CVE-2026-23375

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: thp: deny THP for files on anonymous inodes

file_thp_enabled() incorrectly allows THP for files on anonymous inodes

(e.g. guest_memfd and secretmem). These files are created via

alloc_file_pseudo(), which does not call get_write_access() and leaves

inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being

true, they appear as read-only regular files when

CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP

collapse.

Anonymous inodes can never pass the inode_is_open_for_write() check

since their i_writecount is never incremented through the normal VFS

open path. The right thing to do is to exclude them from THP eligibility

altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real

filesystem files (e.g. shared libraries), not for pseudo-filesystem

inodes.

For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create

large folios in the page cache via the collapse path, b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References