CVE-2026-53109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy

powerpc uses pt_frag_refcount as a reference counter for tracking it's

pte and pmd page table fragments. For PTE table, in case of Hash with

64K pagesize, we have 16 fragments of 4K size in one 64K page.

Patch series [1] "mm: free retracted page table by RCU"

added pte_free_defer() to defer the freeing of PTE tables when

retract_page_tables() is called for madvise MADV_COLLAPSE on shmem

range.

[1]: https://lore.kernel.org/all/[email protected]/

pte_free_defer() sets the active flag on the corresponding fragment's

folio & calls pte_fragment_free(), which reduces the pt_frag_refcount.

When pt_frag_refcount reaches 0 (no active fragment using the folio), it

checks if the folio active flag is set, if set, it calls call_rcu to

free the folio, it the active flag is unset then it calls pte_free_now().

Now, this can lead to following

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References