CVE-2026-31397

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()

move_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge

zero pages. For the huge zero page path, src_folio is explicitly set to

NULL, and is used as a sentinel to skip folio operations like lock and

rmap.

In the huge zero page branch, src_folio is NULL, so folio_mk_pmd(NULL,

pgprot) passes NULL through folio_pfn() and page_to_pfn(). With

SPARSEMEM_VMEMMAP this silently produces a bogus PFN, installing a PMD

pointing to non-existent physical memory. On other memory models it is a

NULL dereference.

Use page_folio(src_page) to obtain the valid huge zero folio from the

page, which was obtained from pmd_page() and remains valid throughout.

After commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge

zero folio special"), moved huge zero PMDs must remain special so

vm_normal_page_pmd() continues to treat them as special mappin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References