{"id":"CVE-2026-98507","state":"PUBLISHED","title":"mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G            E     5.10.0-0021.aarch64 #1\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01\nCall trace:\n __switch_to+0x7c/0xbc\n __schedule+0x3b4/0x8a0\n schedule+0x50/0xe0\n rwsem_down_write_slowpath+0x3cc/0x6cc\n down_write+0x60/0x260\n __anon_vma_prepare+0x6c/0x210\n do_anonymous_page+0x258/0x660\n handle_pte_fault+0x188/0x214\n __handle_mm_fault+0x1b0/0x380\n handle_mm_fault+0xf4/0x284\n do_page_fault+0x19c/0x494\n do_translation_fault+0xcc/0xf8\n do_mem_abort+0x48/0xac\n el0_da+0x44/0x80\n el0_sync_handler+0x88/0xb4\n el0_sync+0x160/0x180\n\nAfter analyzing the vmcore, we found the anon_vma->root->rwsem.count is\n-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the\nanon_vma->root->rwsem.owner shows the lock is held, but the stack of the\ntask shows the task doesn't hold the anon_vma lock.\n\nAfter adding more debugging info, we found __anon_vma_prepare() reuses\nanon_vma and triggers the UAF of anon_vma->root due to missing memory\nbarrier, leading to locking and unlocking two different anon_vma->root,\nthus leading to an anon_vma will never be unlocked, and another anon_vma\ncouldn't be locked anymore.\n\nThis race requires two adjacent VMAs that are not merged but are\nanon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be\nchanged by mprotect()).  Two threads fault on each VMA concurrently, both\ncalling __anon_vma_prepare() with only mmap_lock held for reading.\n\n    THREAD A                             THREAD B\n__anon_vma_prepare                __anon_vma_prepare\n find_mergeable_anon_vma() -> NULL\n anon_vma = anon_vma_alloc();\n   anon_vma->root = anon_vma;\n // the two stores may be reordered\n vma->anon_vma = anon_vma;\n                                   // finds A's anon_vma\n                                   anon_vma = find_mergeable_anon_vma(vma);\n                                   anon_vma_lock_write(anon_vma);\n                                     // may still see the old root\n                                     down_write(&anon_vma->root->rwsem);\n                                   anon_vma_unlock_write(anon_vma);\n                                     // see the new root, never unlock old\n                                     up_write(&anon_vma->root->rwsem);\n\nthread A triggers page fault and calls __anon_vma_prepare() to prepare\nanon_vma for the faulting vma.  __anon_vma_prepare() allocates and\ninitializes a new anon_vma, and then publishes it to the vma with a plain\nstore.  anon_vma_prepare() only requires the mmap_lock to be held for\nreading, so two threads can fault on adjacent VMAs at the same time. \nWhile thread A publishes a new anon_vma, thread B could find the anon_vma\nvia find_mergeable_anon_vma() and then locks anon_vma->root->rwsem.\n\nThe store to anon_vma->root in anon_vma_alloc() and the store to\nvma->anon_vma can be reordered.  The anon_vma_lock_write() and spin_lock()\nonly provide acquire semantics, which do not prevent prior stores from\nbeing reordered after them.  The release semantics of the corresponding\nspin_unlock() and anon_vma_unlock_write() come too late, the store to\nvma->anon_vma is already published before they take effect.  As a result,\nthread B can observe the following order:\n\n    vma->anon_vma = anon_vma;\n    anon_vma->root = anon_vma;\n\nThe anon_vma slab is SLAB_TYPESAFE_BY_RCU, so a newly allocated anon_vma\nmay reuse memory from a previously freed one.  The constructor\n(anon_vma_ctor) does not reset anon_vma->root, and __put_anon_vma()\ndoesn't clear it either, so the old root value persists until\nanon_vma_alloc() overwrites it.  If that store isn't v\n---truncated---","publishedAt":"2026-10-18T15:17:13.767Z","updatedAt":"2026-10-30T12:38:20.652Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"badedec499f6320742368c73fa77cd63dcf8ca55","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"aef0f69b515af1c8a4147f68a46b6b81854f46f7","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"7d103fc7b836084af585d9d3471334624354cf26","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"465e222815c8839445d09028fa4c77e70f7f1c7d","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"a500df43cde075f6ea4b8bae495d89f2c35b3e16","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"4cef512a955e4008ae4436a4fc97726976df1fdf","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"d348a715380bfcc6a611bdf722169d53fd01e735","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"b6ac0b3f6013c168f22cad97e79967accacb08e1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/rmap.c","mm/vma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/rmap.c","mm/vma.c"]}],"references":["https://git.kernel.org/stable/c/badedec499f6320742368c73fa77cd63dcf8ca55","https://git.kernel.org/stable/c/aef0f69b515af1c8a4147f68a46b6b81854f46f7","https://git.kernel.org/stable/c/7d103fc7b836084af585d9d3471334624354cf26","https://git.kernel.org/stable/c/465e222815c8839445d09028fa4c77e70f7f1c7d","https://git.kernel.org/stable/c/a500df43cde075f6ea4b8bae495d89f2c35b3e16","https://git.kernel.org/stable/c/4cef512a955e4008ae4436a4fc97726976df1fdf","https://git.kernel.org/stable/c/d348a715380bfcc6a611bdf722169d53fd01e735","https://git.kernel.org/stable/c/b6ac0b3f6013c168f22cad97e79967accacb08e1"],"weaknesses":[],"ingestedAt":"2026-10-30T12:58:04.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98507.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98507","state":"PUBLISHED","datePublished":"2026-10-18T15:17:13.767Z","dateUpdated":"2026-10-30T12:38:20.652Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.354Z"},"containers":{"cna":{"title":"mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G            E     5.10.0-0021.aarch64 #1\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01\nCall trace:\n __switch_to+0x7c/0xbc\n __schedule+0x3b4/0x8a0\n schedule+0x50/0xe0\n rwsem_down_write_slowpath+0x3cc/0x6cc\n down_write+0x60/0x260\n __anon_vma_prepare+0x6c/0x210\n do_anonymous_page+0x258/0x660\n handle_pte_fault+0x188/0x214\n __handle_mm_fault+0x1b0/0x380\n handle_mm_fault+0xf4/0x284\n do_page_fault+0x19c/0x494\n do_translation_fault+0xcc/0xf8\n do_mem_abort+0x48/0xac\n el0_da+0x44/0x80\n el0_sync_handler+0x88/0xb4\n el0_sync+0x160/0x180\n\nAfter analyzing the vmcore, we found the anon_vma->root->rwsem.count is\n-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the\nanon_vma->root->rwsem.owner shows the lock is held, but the stack of the\ntask shows the task doesn't hold the anon_vma lock.\n\nAfter adding more debugging info, we found __anon_vma_prepare() reuses\nanon_vma and triggers the UAF of anon_vma->root due to missing memory\nbarrier, leading to locking and unlocking two different anon_vma->root,\nthus leading to an anon_vma will never be unlocked, and another anon_vma\ncouldn't be locked anymore.\n\nThis race requires two adjacent VMAs that are not merged but are\nanon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be\nchanged by mprotect()).  Two threads fault on each VMA concurrently, both\ncalling __anon_vma_prepare() with only mmap_lock held for reading.\n\n    THREAD A                             THREAD B\n__anon_vma_prepare                __anon_vma_prepare\n find_mergeable_anon_vma() -> NULL\n anon_vma = anon_vma_alloc();\n   anon_vma->root = anon_vma;\n // the two stores may be reordered\n vma->anon_vma = anon_vma;\n                                   // finds A's anon_vma\n                                   anon_vma = find_mergeable_anon_vma(vma);\n                                   anon_vma_lock_write(anon_vma);\n                                     // may still see the old root\n                                     down_write(&anon_vma->root->rwsem);\n                                   anon_vma_unlock_write(anon_vma);\n                                     // see the new root, never unlock old\n                                     up_write(&anon_vma->root->rwsem);\n\nthread A triggers page fault and calls __anon_vma_prepare() to prepare\nanon_vma for the faulting vma.  __anon_vma_prepare() allocates and\ninitializes a new anon_vma, and then publishes it to the vma with a plain\nstore.  anon_vma_prepare() only requires the mmap_lock to be held for\nreading, so two threads can fault on adjacent VMAs at the same time. \nWhile thread A publishes a new anon_vma, thread B could find the anon_vma\nvia find_mergeable_anon_vma() and then locks anon_vma->root->rwsem.\n\nThe store to anon_vma->root in anon_vma_alloc() and the store to\nvma->anon_vma can be reordered.  The anon_vma_lock_write() and spin_lock()\nonly provide acquire semantics, which do not prevent prior stores from\nbeing reordered after them.  The release semantics of the corresponding\nspin_unlock() and anon_vma_unlock_write() come too late, the store to\nvma->anon_vma is already published before they take effect.  As a result,\nthread B can observe the following order:\n\n    vma->anon_vma = anon_vma;\n    anon_vma->root = anon_vma;\n\nThe anon_vma slab is SLAB_TYPESAFE_BY_RCU, so a newly allocated anon_vma\nmay reuse memory from a previously freed one.  The constructor\n(anon_vma_ctor) does not reset anon_vma->root, and __put_anon_vma()\ndoesn't clear it either, so the old root value persists until\nanon_vma_alloc() overwrites it.  If that store isn't v\n---truncated---"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"badedec499f6320742368c73fa77cd63dcf8ca55","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"aef0f69b515af1c8a4147f68a46b6b81854f46f7","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"7d103fc7b836084af585d9d3471334624354cf26","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"465e222815c8839445d09028fa4c77e70f7f1c7d","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"a500df43cde075f6ea4b8bae495d89f2c35b3e16","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"4cef512a955e4008ae4436a4fc97726976df1fdf","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"d348a715380bfcc6a611bdf722169d53fd01e735","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"b6ac0b3f6013c168f22cad97e79967accacb08e1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/rmap.c","mm/vma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/rmap.c","mm/vma.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/badedec499f6320742368c73fa77cd63dcf8ca55"},{"url":"https://git.kernel.org/stable/c/aef0f69b515af1c8a4147f68a46b6b81854f46f7"},{"url":"https://git.kernel.org/stable/c/7d103fc7b836084af585d9d3471334624354cf26"},{"url":"https://git.kernel.org/stable/c/465e222815c8839445d09028fa4c77e70f7f1c7d"},{"url":"https://git.kernel.org/stable/c/a500df43cde075f6ea4b8bae495d89f2c35b3e16"},{"url":"https://git.kernel.org/stable/c/4cef512a955e4008ae4436a4fc97726976df1fdf"},{"url":"https://git.kernel.org/stable/c/d348a715380bfcc6a611bdf722169d53fd01e735"},{"url":"https://git.kernel.org/stable/c/b6ac0b3f6013c168f22cad97e79967accacb08e1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - A local memory fault reaches patched __anon_vma_prepare() via do_mem_abort() → do_page_fault() → handle_mm_fault() → __handle_mm_fault() → handle_pte_fault() → do_anonymous_page() → __vmf_anon_prepare(); no network data enters this path.\nAC:L - The attacker can use mprotect() to create adjacent unmerged VMAs differing in VMA_ACCESS_FLAGS, groom stale non-self roots through fork/exit, and concurrently fault both VMAs. They control both sides of the reusable_anon_vma() race and can retry the weak-memory window.\nPR:L - mmap(), mprotect(), fork()/clone(), and faults on the caller's own mappings require no capability; neither __vmf_anon_prepare() nor __anon_vma_prepare() performs a credential check. An ordinary unprivileged local process can reach the flaw.\nUI:N - The attacking process creates the VMA layout, grooms the anon_vma cache, and drives both concurrent faults itself; no action by another user is required.\nS:U - The stale root dereference and rwsem corruption occur in the host kernel's anon_vma memory-management state reached from the attacker's process; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - reusable_anon_vma() can return a newly allocated SLAB_TYPESAFE_BY_RCU object while its root still names a freed prior anon_vma, after which anon_vma_lock_write() dereferences the stale root->rwsem. Same-cache grooming therefore provides a use-after-free read over recycled kernel object state.\nI:H - down_write() writes count and owner state through the freed or reallocated old root, while anon_vma_unlock_write() rereads the initialized root and up_write() corrupts that different semaphore, as demonstrated by counts 1 and -1. These are cross-object UAF writes into a groomable kernel slab.\nA:H - The mismatched down_write()/up_write() leaves the old anon_vma root permanently locked and underflows the new root's rwsem count, producing the reported uninterruptible hung task in __anon_vma_prepare(); repeated poisoned roots can block further faults and rmap operations."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:38:20.652Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.18.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.2.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}