CVE-2026-31456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix race between concurrent split and refault

The splitting of a PUD entry in walk_pud_range() can race with a

concurrent thread refaulting the PUD leaf entry causing it to try walking

a PMD range that has disappeared.

An example and reproduction of this is to try reading numa_maps of a

process while VFIO-PCI is setting up DMA (specifically the

vfio_pin_pages_remote call) on a large BAR for that process.

This will trigger a kernel BUG:

vfio-pci 0000:03:00.0: enabling device (0000 -> 0002)

BUG: unable to handle page fault for address: ffffa23980000000

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP NOPTI

...

RIP: 0010:walk_pgd_range+0x3b5/0x7a0

Code: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24

28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 <49> f7 06

9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74

RSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287

RAX: 00007f44c01fffff RBX:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References