{"id":"CVE-2026-23375","state":"PUBLISHED","title":"mm: thp: deny THP for files on anonymous inodes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: thp: deny THP for files on anonymous inodes\n\nfile_thp_enabled() incorrectly allows THP for files on anonymous inodes\n(e.g. guest_memfd and secretmem). These files are created via\nalloc_file_pseudo(), which does not call get_write_access() and leaves\ninode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being\ntrue, they appear as read-only regular files when\nCONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP\ncollapse.\n\nAnonymous inodes can never pass the inode_is_open_for_write() check\nsince their i_writecount is never incremented through the normal VFS\nopen path. The right thing to do is to exclude them from THP eligibility\naltogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real\nfilesystem files (e.g. shared libraries), not for pseudo-filesystem\ninodes.\n\nFor guest_memfd, this allows khugepaged and MADV_COLLAPSE to create\nlarge folios in the page cache via the collapse path, but the\nguest_memfd fault handler does not support large folios. This triggers\nWARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping().\n\nFor secretmem, collapse_file() tries to copy page contents through the\ndirect map, but secretmem pages are removed from the direct map. This\ncan result in a kernel crash:\n\n    BUG: unable to handle page fault for address: ffff88810284d000\n    RIP: 0010:memcpy_orig+0x16/0x130\n    Call Trace:\n     collapse_file\n     hpage_collapse_scan_file\n     madvise_collapse\n\nSecretmem is not affected by the crash on upstream as the memory failure\nrecovery handles the failed copy gracefully, but it still triggers\nconfusing false memory failure reports:\n\n    Memory failure: 0x106d96f: recovery action for clean unevictable\n    LRU page: Recovered\n\nCheck IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all\nanonymous inode files.","publishedAt":"2026-03-25T10:27:55.754Z","updatedAt":"2026-05-11T22:05:39.614Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"08de46a75f91a6661bc1ce0a93614f4bc313c581","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"0524ee56af2c9bfbad152a810f1ca95de8ca00d7","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"f6fa05f0dddd387417d0c28281ddb951582514d6","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"dd085fe9a8ebfc5d10314c60452db38d2b75e609","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/huge_memory.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/huge_memory.c"]}],"references":["https://git.kernel.org/stable/c/08de46a75f91a6661bc1ce0a93614f4bc313c581","https://git.kernel.org/stable/c/0524ee56af2c9bfbad152a810f1ca95de8ca00d7","https://git.kernel.org/stable/c/f6fa05f0dddd387417d0c28281ddb951582514d6","https://git.kernel.org/stable/c/dd085fe9a8ebfc5d10314c60452db38d2b75e609"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23375.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23375","state":"PUBLISHED","datePublished":"2026-03-25T10:27:55.754Z","dateUpdated":"2026-05-11T22:05:39.614Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:46.003Z"},"containers":{"cna":{"title":"mm: thp: deny THP for files on anonymous inodes","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: thp: deny THP for files on anonymous inodes\n\nfile_thp_enabled() incorrectly allows THP for files on anonymous inodes\n(e.g. guest_memfd and secretmem). These files are created via\nalloc_file_pseudo(), which does not call get_write_access() and leaves\ninode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being\ntrue, they appear as read-only regular files when\nCONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP\ncollapse.\n\nAnonymous inodes can never pass the inode_is_open_for_write() check\nsince their i_writecount is never incremented through the normal VFS\nopen path. The right thing to do is to exclude them from THP eligibility\naltogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real\nfilesystem files (e.g. shared libraries), not for pseudo-filesystem\ninodes.\n\nFor guest_memfd, this allows khugepaged and MADV_COLLAPSE to create\nlarge folios in the page cache via the collapse path, but the\nguest_memfd fault handler does not support large folios. This triggers\nWARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping().\n\nFor secretmem, collapse_file() tries to copy page contents through the\ndirect map, but secretmem pages are removed from the direct map. This\ncan result in a kernel crash:\n\n    BUG: unable to handle page fault for address: ffff88810284d000\n    RIP: 0010:memcpy_orig+0x16/0x130\n    Call Trace:\n     collapse_file\n     hpage_collapse_scan_file\n     madvise_collapse\n\nSecretmem is not affected by the crash on upstream as the memory failure\nrecovery handles the failed copy gracefully, but it still triggers\nconfusing false memory failure reports:\n\n    Memory failure: 0x106d96f: recovery action for clean unevictable\n    LRU page: Recovered\n\nCheck IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all\nanonymous inode files."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"08de46a75f91a6661bc1ce0a93614f4bc313c581","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"0524ee56af2c9bfbad152a810f1ca95de8ca00d7","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"f6fa05f0dddd387417d0c28281ddb951582514d6","versionType":"git"},{"version":"7fbb5e188248c50f737720825da1864ce42536d1","status":"affected","lessThan":"dd085fe9a8ebfc5d10314c60452db38d2b75e609","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/huge_memory.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/huge_memory.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/08de46a75f91a6661bc1ce0a93614f4bc313c581"},{"url":"https://git.kernel.org/stable/c/0524ee56af2c9bfbad152a810f1ca95de8ca00d7"},{"url":"https://git.kernel.org/stable/c/f6fa05f0dddd387417d0c28281ddb951582514d6"},{"url":"https://git.kernel.org/stable/c/dd085fe9a8ebfc5d10314c60452db38d2b75e609"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T22:05:39.614Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.18.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.19.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}