CVE-2026-72043

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

When hardware page table walker (PTW) is enabled on LoongArch, the CPU

may set _PAGE_DIRTY directly in the page table entry during a write TLB

miss, without going through the software TLB store handler. The software

TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED

together:

ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)

Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.

_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has

_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED

clear (software is unaware).

When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls

pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and

_PAGE_DIRTY bits:

pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);

Since _PAGE_MODIFIED was never set, the dirtin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References