CVE-2026-31466

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix folio isn't locked in softleaf_to_folio()

On arm64 server, we found folio that get from migration entry isn't locked

in softleaf_to_folio(). This issue triggers when mTHP splitting and

zap_nonpresent_ptes() races, and the root cause is lack of memory barrier

in softleaf_to_folio(). The race is as follows:

CPU0 CPU1

deferred_split_scan() zap_nonpresent_ptes()

lock folio

split_folio()

unmap_folio()

change ptes to migration entries

__split_folio_to_order() softleaf_to_folio()

set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))

smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))

prep_compound_page() for tail pages

In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References