CVE-2026-72043 - Vulnerability Details

- LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

When hardware page table walker (PTW) is enabled on LoongArch, the CPU
may set _PAGE_DIRTY directly in the page table entry during a write TLB
miss, without going through the software TLB store handler. The software
TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED
together:

ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)

Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.
_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has
_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED
clear (software is unaware).

When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls
pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and
_PAGE_DIRTY bits:

pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);

Since _PAGE_MODIFIED was never set, the dirtiness information is lost
completely. Subsequently, when memory pressure triggers page reclaim,
page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty()
returns false) and the page may be freed without writeback, causing data
corruption.

Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in
both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:

if (pte_val(pte) & _PAGE_DIRTY)
pte_val(pte) |= _PAGE_MODIFIED;

The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,
where pmd entries need the same treatment.

This ensures the software dirty tracking bit (checked by pte_dirty() and
pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is
preserved across fork COW write-protection.

The issue was found by the LTP madvise09 test case, which exercises page
reclaim after "madvise(MADV_FREE), write and fork" operation sequence on
private anonymous mappings.

Published: 2026-08-15

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel on LoongArch processors with the hardware page table walker enabled fails to propagate the _PAGE_DIRTY flag into the _PAGE_MODIFIED bit during write TLB misses. When a fork or clone operation triggers copy‑on‑write, the kernel’s pte_wrprotect() routine clears both the write and dirty bits, leaving the software dirty‑tracking bit unset. Consequently the page is considered clean during reclaim and may be freed without being written back, which can result in the loss or corruption of data that had been written to memory. The flaw represents a defect in the kernel’s handling of page‑table state and can lead to integrity failures.

Affected Systems

All versions of the Linux kernel that run on LoongArch CPUs with the hardware page table walker enabled and have not applied the patch referenced in the commit logs. No specific patch level is supplied, so any pre‑patch kernel that supports LoongArch and PTW is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates medium‑high severity. The EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploits to date. The likely attack vector is local, requiring a process to write to memory and then trigger a fork or a madvise(MADV_FREE) that creates page‑reclaim pressure. If successful, the kernel may free a dirty page without writeback, leading to data corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< 76f88650763a35cbf1384c65d66d096fa31cc58d
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< e8a916579e427af32f2de8213dfa23c5df6e6664
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< 39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< a65f49b6f7ece756394f8f0e85570020e7fd0e35
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< e483da960892c41fa7f0cf0d2fc2410d65a483d6
`09cfefb7fa70c3af011b0db0a513fd80b2f18abc`	affected	< 018e9828eb523c638fa3d9bdf0fd4956b74555b2

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,76f88650763a35cbf1384c65d66d096fa31cc58d)`	affected	code_commit	—
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,e8a916579e427af32f2de8213dfa23c5df6e6664)`	affected	code_commit	—
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9)`	affected	code_commit	—
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,a65f49b6f7ece756394f8f0e85570020e7fd0e35)`	affected	code_commit	—
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,e483da960892c41fa7f0cf0d2fc2410d65a483d6)`	affected	code_commit	—
`[09cfefb7fa70c3af011b0db0a513fd80b2f18abc,018e9828eb523c638fa3d9bdf0fd4956b74555b2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	semver	—
`[0,5.19)`	unaffected	semver	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the Linux kernel patch that updates pte_wrprotect() and pmd_wrprotect() to propagate the _PAGE_DIRTY flag to _PAGE_MODIFIED before clearing write access
Reboot the affected nodes after applying the kernel update to activate the new page‑table handling
If an immediate patch cannot be applied, disable the LoongArch hardware page table walker by removing the CONFIG_HW_PTW configuration or using a kernel boot parameter that prevents PTW use
Avoid patterns that trigger copy‑on‑write followed by MADV_FREE or extensive fork/clone activity on private anonymous mappings until a patched kernel is deployed

Generated by OpenCVE AI on August 18, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0016.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/018e9828eb523c638fa3d9bdf0fd4956b74555b2
https://git.kernel.org/stable/c/39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9
https://git.kernel.org/stable/c/76f88650763a35cbf1384c65d66d096fa31cc58d
https://git.kernel.org/stable/c/a65f49b6f7ece756394f8f0e85570020e7fd0e35
https://git.kernel.org/stable/c/e483da960892c41fa7f0cf0d2fc2410d65a483d6
https://git.kernel.org/stable/c/e8a916579e427af32f2de8213dfa23c5df6e6664
https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72043-d927@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72043
https://www.cve.org/CVERecord?id=CVE-2026-72043

History

Tue, 18 Aug 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72043-d927@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72043 https://www.cve.org/CVERecord?id=CVE-2026-72043
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`

Sat, 15 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB miss, without going through the software TLB store handler. The software TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED together: ori t0, t0, (_PAGE_VALID \| _PAGE_DIRTY \| _PAGE_MODIFIED) Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. _PAGE_MODIFIED is left unchanged. This creates a window where a PTE has _PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED clear (software is unaware). When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and _PAGE_DIRTY bits: pte_val(pte) &= ~(_PAGE_WRITE \| _PAGE_DIRTY); Since _PAGE_MODIFIED was never set, the dirtiness information is lost completely. Subsequently, when memory pressure triggers page reclaim, page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() returns false) and the page may be freed without writeback, causing data corruption. Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: if (pte_val(pte) & _PAGE_DIRTY) pte_val(pte) \|= _PAGE_MODIFIED; The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, where pmd entries need the same treatment. This ensures the software dirty tracking bit (checked by pte_dirty() and pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is preserved across fork COW write-protection. The issue was found by the LTP madvise09 test case, which exercises page reclaim after "madvise(MADV_FREE), write and fork" operation sequence on private anonymous mappings.
Title		LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/018e9828eb523c638fa3d9bdf0fd4956b74555b2 https://git.kernel.org/stable/c/39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9 https://git.kernel.org/stable/c/76f88650763a35cbf1384c65d66d096fa31cc58d https://git.kernel.org/stable/c/a65f49b6f7ece756394f8f0e85570020e7fd0e35 https://git.kernel.org/stable/c/e483da960892c41fa7f0cf0d2fc2410d65a483d6 https://git.kernel.org/stable/c/e8a916579e427af32f2de8213dfa23c5df6e6664

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:02.505Z

Updated: 2026-08-17T05:39:42.678Z

Reserved: 2026-08-09T03:40:39.902Z

Link: CVE-2026-72043

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:13.480

Modified: 2026-08-17T06:18:02.257

Link: CVE-2026-72043

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72043 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T05:30:08Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object