A flaw in the Linux kernel’s memfd live‑update (LUO) mechanism incorrectly preserves the state of folios as clean when they are unmodified. Later writes to such folios leave the kernel with a stale clean flag, so under memory pressure it may reclaim the page, causing loss of user data. The bug arises from improper handling of the dirty‑bit in memfd preservation, leading to desynchronization between serialized state and actual memory contents.

All Linux kernel builds that include the memfd live‑update feature are affected. The advisory does not list specific kernel releases, so any recent kernel versions using this mechanism are potentially vulnerable.

The vulnerability is not listed in CISA’s KEV catalog and its EPSS score is not available, indicating that exploitation has not been widely observed. The flaw only matters on systems that use memfd LUO, such as environments performing live kernel updates. While the attack vector is not explicitly documented, it is inferred that an attacker would need to influence a process that creates a memfd with LUO for the flaw to trigger. The resulting data loss could degrade availability or data integrity but does not directly enable remote code execution or privilege escalation.