CVE-2026-31398

A flaw was found in the Linux kernel's memory management unit (MMU). A local user could exploit this vulnerability by manipulating memory operations, leading to incorrect page table entry (PTE) restoration for lazyfree folios during batch unmapping. This issue can cause memory pages with mixed writable and non-writable attributes to be incorrectly marked as fully writable, violating copy-on-write (CoW) semantics. The consequence of this flaw is a kernel crash, resulting in a denial of service.

A moderate-severity flaw was found in the Linux kernel's memory management reverse-mapping subsystem (mm/rmap), which does not affect any Red Hat Enterprise Linux or Red Hat In-Vehicle OS release. When the kernel batches the unmapping of anonymous lazyfree folios via folio_unmap_pte_batch(), a batch containing both writable and non-writable page table entries (PTEs) can be treated as uniformly writable, so a failed unmap that restores the PTEs may incorrectly mark read-only mappings as writable. This violates copy-on-write (CoW) semantics for anonymous memory. A local unprivileged user who can carry out a specific sequence of memory operations (splitting and merging VMAs around a large folio, marking it lazyfree with MADV_FREE, dirtying it, and triggering memory reclaim) can cause the kernel to crash (a BUG_ON in page_table_check), resulting in a denial of service. Red Hat rated this flaw Moderate impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the demonstrated impact is a kernel crash affecting availability only; the upstream CVE record scores it at 7.8 assuming confidentiality and integrity impact from incorrect writable sharing of anonymous pages, which is not established by the available evidence. All Red Hat Enterprise Linux 7 through 10 and Red Hat In-Vehicle OS 2.0 kernel streams are not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.