CVE-2026-64181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()

On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a

"WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the

VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by

"BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when

reclaim gets to call shrink_huge_zero_folio_scan().

It's as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and

indeed, whereas pte_special() and pte_mkspecial() are subject to a

dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial()

are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on

any 32-bit architecture.

While the problem was exposed through commit d80a9cb1a64a

("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an

oversight in commit af38538801c6 ("mm/memory: factor out common code

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References