Description
In the Linux kernel, the following vulnerability has been resolved:

mm/khugepaged: write all dirty file folios when collapsing

[There is no upstream commit, as this code was removed by upstream
commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")]

As-is, khugepaged and writable-file opening exclude each other. A file
cannot be open writeable and have THPs (because the filesystem is not aware
of them). khugepaged will never collapse file pages for files that are
opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that
particular file is dropped. This is fine because nothing could've been
dirtied.

However, there is an edge-case: collapse_file() might not be able to
coexist with concurrent writers, but it can coexist with dirty folios
(from previous writers). Therefore, the following can happen:

open(file, O_RDWR)
write(file)
close(file)
madvise(file_mapping, MADV_COLLAPSE, some non-dirty range)
open(file, O_RDWR)
nr_thps > 0
truncate_inode_pages()
/* THPs are cleared out, but so are the dirty folios */

When this edge-case happens, there is data loss, as the dirty folios are
fully discarded.

Fix it by fully writing back the page cache (and waiting) when collapsing
file THPs. Doing so provides the guarantee that no dirty folio will be
observed while there are active THPs. To fully ensure this is safe, the
invalidate_lock needs to be held while doing the writeout, so that
do_dentry_open()'s page cache truncation excludes this write-and-wait.

As a side effect, move the nr_thps counter bumping outside the i_pages
lock. This is correct since the counter itself is an atomic_t and the
producer <-> consumer correctness is provided by a full memory barrier:
smp_mb() in collapse_file()/memory barrier implied by full ordering in
get_write_access() -> atomic_inc_unless_negative().
Published: 2026-08-10
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel contains a bug where the kernel module khugepaged fails to write back and flush dirty page cache entries when collapsing large pages, and then discards those dirty folios. This oversight does not execute any code but results in loss of previously written data. The flaw represents a data integrity weakness: data written to a file may be erased when the system collapses transparent huge pages for that file. The kernel compensates for this by blocking this scenario normally, but a race between a write and a collapse can expose the flaw, resulting in silent data loss.

Affected Systems

All kernel builds that include the khugepaged module and support transparent huge pages, before the upstream fix for CVE-2026-68086 was applied. Specific affected versions are not enumerated in the CVE description, but any Linux kernel that has not yet been updated with the commit that corrects the dirty folio handling is vulnerable.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog, but its EPSS score is listed as < 1%, indicating a very low probability of exploitation. The CVSS score of 7.0 indicates a high impact on data integrity, yet only a local user can trigger data loss by opening a writable file and initiating THP collapse via MADV_COLLAPSE. The likely attack vector is local write access followed by a collapsing request, an unprivileged process can perform on its own files. The fix requires acquiring an inode lock while writing out, preventing concurrent writers from modifying dirty data during collapse.

Generated by OpenCVE AI on August 13, 2026 at 10:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel update that contains the khugepaged fix for CVE-2026-68086
  • If a patch is unavailable, disable or restrict the MADV_COLLAPSE operation by setting the kernel’s page collapsing parameters or removing write permissions from files during potential collapse periods
  • Avoid opening files for write while simultaneously invoking THP collapse mechanisms on the same inode. Reboot after applying patches to ensure all in-memory state is cleared

Generated by OpenCVE AI on August 13, 2026 at 10:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-823

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Mon, 10 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-823

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")] As-is, khugepaged and writable-file opening exclude each other. A file cannot be open writeable and have THPs (because the filesystem is not aware of them). khugepaged will never collapse file pages for files that are opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that particular file is dropped. This is fine because nothing could've been dirtied. However, there is an edge-case: collapse_file() might not be able to coexist with concurrent writers, but it can coexist with dirty folios (from previous writers). Therefore, the following can happen: open(file, O_RDWR) write(file) close(file) madvise(file_mapping, MADV_COLLAPSE, some non-dirty range) open(file, O_RDWR) nr_thps > 0 truncate_inode_pages() /* THPs are cleared out, but so are the dirty folios */ When this edge-case happens, there is data loss, as the dirty folios are fully discarded. Fix it by fully writing back the page cache (and waiting) when collapsing file THPs. Doing so provides the guarantee that no dirty folio will be observed while there are active THPs. To fully ensure this is safe, the invalidate_lock needs to be held while doing the writeout, so that do_dentry_open()'s page cache truncation excludes this write-and-wait. As a side effect, move the nr_thps counter bumping outside the i_pages lock. This is correct since the counter itself is an atomic_t and the producer <-> consumer correctness is provided by a full memory barrier: smp_mb() in collapse_file()/memory barrier implied by full ordering in get_write_access() -> atomic_inc_unless_negative().
Title mm/khugepaged: write all dirty file folios when collapsing
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T11:51:40.304Z

Reserved: 2026-07-30T09:28:09.367Z

Link: CVE-2026-68086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-10T12:17:21.207

Modified: 2026-08-10T12:17:21.207

Link: CVE-2026-68086

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68086 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:45:04Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition