CVE-2026-31575 - Vulnerability Details

- mm/userfaultfd: fix hugetlb fault mutex hash calculation

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix hugetlb fault mutex hash calculation

In mfill_atomic_hugetlb(), linear_page_index() is used to calculate the
page index for hugetlb_fault_mutex_hash(). However, linear_page_index()
returns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()
expects the index in huge page units. This mismatch means that different
addresses within the same huge page can produce different hash values,
leading to the use of different mutexes for the same huge page. This can
cause races between faulting threads, which can corrupt the reservation
map and trigger the BUG_ON in resv_map_release().

Fix this by introducing hugetlb_linear_page_index(), which returns the
page index in huge page granularity, and using it in place of
linear_page_index().

Published: 2026-04-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, a race condition in hugetlb fault handling is triggered when the page index used to locate a hugetlb fault mutex does not match the expected huge page granularity. The mismatch leads to different mutexes being used for addresses within the same huge page, corrupting a reservation map and causing a BUG_ON on release. The flaw can cause kernel memory corruption, which may result in a system crash. The weakness is identified by CWE-821 and NVD-CWE-noinfo.

Affected Systems

All Linux kernel builds that contain the buggy hugetlb fault handling routine before the fix, including all current and previous releases that have not yet incorporated the patch. The affected product is the Linux kernel, version unspecified in the advisory.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is reported as less than 1%, indicating a low probability of exploitation in the wild. CVE-2026-31575 is not listed in CISA’s KEV catalog. Exploitation would require an attacker to trigger the hugetlb fault mechanism, which can be done via the userfaultfd interface. An attacker with local user privileges could induce the race to crash the system, but remote or privilege‑escalating exploitation is not supported by the available information.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3`	affected	< 5a525c43baaba0bf3063f86996ca3623b71e4172
`a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3`	affected	< 574501ede47ac439afd67ba9812bc66722d500ba
`a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3`	affected	< 08282b1bf74c69fc8ecd25493e7fdb5460f01290
`a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3`	affected	< f4689fc089765d36c026063fb22d23533e883eb6
`a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3`	affected	< 0217c7fb4de4a40cee667eb21901f3204effe5ac

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.84`	unaffected	≤ 6.12.*
`6.18.24`	unaffected	≤ 6.18.*
`6.19.14`	unaffected	≤ 6.19.*
`7.0.1`	unaffected	≤ 7.0.*
`7.1-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3,5a525c43baaba0bf3063f86996ca3623b71e4172)`	affected	code_commit	—
`[a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3,574501ede47ac439afd67ba9812bc66722d500ba)`	affected	code_commit	—
`[a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3,08282b1bf74c69fc8ecd25493e7fdb5460f01290)`	affected	code_commit	—
`[a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3,f4689fc089765d36c026063fb22d23533e883eb6)`	affected	code_commit	—
`[a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3,0217c7fb4de4a40cee667eb21901f3204effe5ac)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.7`	affected	semver	—
`[0,6.7)`	unaffected	semver	—
`[6.12.84,6.13.0)`	unaffected	semver	—
`[6.18.24,6.19.0)`	unaffected	semver	—
`[6.19.14,6.20.0)`	unaffected	semver	—
`[7.0.1,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the hugetlb_linear_page_index() fix.
If updating is not immediately possible, restrict or disable the use of userfaultfd in combination with huge pages on affected systems.
Monitor system logs for unexpected BUG_ON occurrences or kernel crashes and apply the patch as soon as it becomes available.

Generated by OpenCVE AI on April 28, 2026 at 14:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac
https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290
https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba
https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172
https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6
https://lore.kernel.org/linux-cve-announce/2026042409-CVE-2026-31575-c1bf@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31575
https://www.cve.org/CVERecord?id=CVE-2026-31575

History

Mon, 27 Apr 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172

Mon, 27 Apr 2026 11:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026042409-CVE-2026-31575-c1bf@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31575 https://www.cve.org/CVERecord?id=CVE-2026-31575
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix hugetlb fault mutex hash calculation In mfill_atomic_hugetlb(), linear_page_index() is used to calculate the page index for hugetlb_fault_mutex_hash(). However, linear_page_index() returns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash() expects the index in huge page units. This mismatch means that different addresses within the same huge page can produce different hash values, leading to the use of different mutexes for the same huge page. This can cause races between faulting threads, which can corrupt the reservation map and trigger the BUG_ON in resv_map_release(). Fix this by introducing hugetlb_linear_page_index(), which returns the page index in huge page granularity, and using it in place of linear_page_index().
Title		mm/userfaultfd: fix hugetlb fault mutex hash calculation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290 https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:42:07.502Z

Updated: 2026-05-11T22:11:26.533Z

Reserved: 2026-03-09T15:48:24.119Z

Link: CVE-2026-31575

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:32.123

Modified: 2026-04-27T23:15:42.890

Link: CVE-2026-31575

Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31575 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T14:15:34Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object