CVE-2026-53108

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: Fix unmap race with PMD migration entries

The following race is possible with migration swap entries or

device-private THP entries. e.g. when move_pages is called on a PMD THP

page, then there maybe an intermediate state, where PMD entry acts as

a migration swap entry (pmd_present() is true). Then if an munmap

happens at the same time, then this VM_BUG_ON() can happen in

pmdp_huge_get_and_clear_full().

This patch fixes that.

Thread A: move_pages() syscall

add_folio_for_migration()

mmap_read_lock(mm)

folio_isolate_lru(folio)

mmap_read_unlock(mm)

do_move_pages_to_node()

migrate_pages()

try_to_migrate_one()

spin_lock(ptl)

set_pmd_migration_entry()

pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn

set_pmd_at() # PMD: migration swap entry (pmd_present=0)

spin_unlock(ptl)

[page copy phase] # <--- RACE WIN

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References