CVE-2026-31398

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/rmap: fix incorrect pte restoration for lazyfree folios

We batch unmap anonymous lazyfree folios by folio_unmap_pte_batch. If the

batch has a mix of writable and non-writable bits, we may end up setting

the entire batch writable. Fix this by respecting writable bit during

batching.

Although on a successful unmap of a lazyfree folio, the soft-dirty bit is

lost, preserve it on pte restoration by respecting the bit during

batching, to make the fix consistent w.r.t both writable bit and

soft-dirty bit.

I was able to write the below reproducer and crash the kernel.

Explanation of reproducer (set 64K mTHP to always):

Fault in a 64K large folio. Split the VMA at mid-point with

MADV_DONTFORK. fork() - parent points to the folio with 8 writable ptes

and 8 non-writable ptes. Merge the VMAs with MADV_DOFORK so that

folio_unmap_pte_batch() can determine all the 16 ptes as a batch. Do

MADV_FREE on the range to mark t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References