Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-72180

mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade change_non_present_huge_pmd() rewrites a writable device-private PMD swap entry into a readable one without carrying pmd_swp_uffd_wp() across. The PTE-level change_softleaf_pte() does this correctly; mirror that here, matching what copy_huge_pmd() does for the fork path. Without the carry, a plain mprotect() over a UFFD_WP-marked device-private THP strips the bit and the trap is bypassed on swap-in.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 368076f52ebeecd33e10a9f80905d7508b6b6149 to < 2611f7521c6c124b1bef1be4fc319e0ca144502faffected
  • 368076f52ebeecd33e10a9f80905d7508b6b6149 to < f7e2c21bd1f57cd5350eecdfdb5d6025ca6afbabaffected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References