Impact
The bug arises from the use of the pmd_write() helper on a softleaf PMD entry in the migrate path. When a device‑private huge page is migrated, the helper incorrectly interprets the soft‑dirty flag as a writable bit, causing the kernel to install a PMD entry that is marked writeable even though the page should be read‑only. The result is that the rmap data structures become inconsistent, an extra reference count appears, and an assertion in the kernel is triggered, which indicates memory corruption has occurred. The corruption can potentially leak or overwrite kernel data, creating a dangerous state that could be abused for privilege escalation. The underlying CWE is improper access control through incorrect flag handling.
Affected Systems
All Linux kernel releases that contain the buggy code path – the commit that introduced the flaw (65edfda6f3f2) and any revisions that have not been backpatched – are affected. Affected systems will include all distributions that ship a kernel before the fix commit (775465fd26a3) is applied. The bug exists regardless of distribution or kernel configuration, but it only manifests when device‑private huge pages are migrated or when the test harness in the kernel’s test suite performs the migration sequence described in the advisory.
Risk and Exploitability
The advisory does not provide a CVSS score or EPSS estimate, so the quantified risk is unavailable. However, because the flaw causes kernel memory corruption and can change page permissions, it is reasonably likely to be exploitable by a locally privileged user who can trigger the migration path, or potentially by a remote user able to coerce the kernel into such a state. Since the flaw is not yet listed in CISA KEV, it has not been observed in active exploitation yet, but the theoretical attack surface is high. The likely attack vector involves manipulating memory migration requests – for example, via device‑private huge page allocation or by using the hmm test harness in a privileged context – to cause the kernel to install an inappropriate PMD entry that then corrupts rmap structures.
OpenCVE Enrichment