CVE-2026-64514

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: gate must_wait writability check on pte_present()

userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE

without taking the page table lock and then apply pte_write() /

huge_pte_write() to it. Those accessors decode bits from the present

encoding only; on a swap or migration entry they read the offset bits that

happen to share the same position and return an undefined result.

The intent of the check is "is this fault still WP-blocked?". A

non-marker swap entry means the page is in transit -- the userfault

context the original fault delivered against is no longer the same, and

the swap-in or migration completion path will re-deliver a fresh fault if

userspace still needs to handle it. Worst case under the current code the

garbage write bit says "wait", and the thread stays asleep until a

UFFDIO_WAKE that may never arrive.

Gate the writability check on pte_present() so the lockless re-c

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References