CVE-2026-80893

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

copy_hugetlb_page_range() clears the uffd-wp bit of migration and hwpoison

entries with huge_pte_clear_uffd_wp(), which operates on the present-PTE

bit position. Swap entries keep the uffd-wp state elsewhere -- the

migration branch reads and sets it with pte_swp_uffd_wp() and

pte_swp_mkuffd_wp() -- and the present-PTE position falls into the swap

payload. On x86-64 it lands in the inverted swap offset, where a

naturally-aligned hugetlb PFN always has the affected bit set, so the

clear advances the encoded PFN by two pages.

No userfaultfd needs to be involved: the clear is guarded only by the

child VMA not being uffd-wp registered, so a plain fork() with an

in-flight hugetlb migration entry (or a poisoned hugetlb page) corrupts

the entry copied into the child. Instrumenting the clear and forking

after MADV_HWPOISON on a 2MB anon hugetlb page sho

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References