CVE-2026-31648

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I

encountered some very strange crash issues showing up as "Bad page state":

"

[ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb

[ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb

[ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff)

[ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000

[ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000

[ 734.496442] page dumped because: nonzero mapcount

"

After analyzing this page’s state, it is hard to understand why the

mapcount is not 0 while the refcount is 0, since this page is not where

the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can

reproduce the cr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References