CVE-2026-97945

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix user-space data loss with MADV_FREE and THP

Some of users of Polars (a data analytics library) have lost production

data from this bug. They seem to have just the right combination of

huge pages, MADV_FREE and heavy reclaim pressure.

pmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY),

silently discarding the hardware dirty bit. The subsequent

pmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into

_PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already

stripped from the value, so there is nothing left to transfer.

Contrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask,

and pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify()

is the odd one out. Any pmd_modify() on a writable, dirty PMD loses

the dirty state.

One visible consequence is data loss with MADV_FREE on PMD-mapped THP:

memset(buf, 0x5A, size); // PMD-mapped

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References