CVE-2026-72043

A flaw was found in the Linux kernel, specifically affecting the LoongArch architecture when the hardware page table walker (PTW) is enabled. This vulnerability stems from a missing dirty page tracking mechanism in the pte_wrprotect() and pmd_wrprotect() functions, which can lead to incorrect handling of memory pages during copy-on-write operations. As a result, a local user could potentially trigger data corruption, where modified pages are prematurely freed without their contents being properly written back to storage.

A moderate-impact flaw was found in the Linux kernel on the LoongArch architecture when the hardware page table walker (PTW) is enabled. In this configuration, the CPU may set the _PAGE_DIRTY bit in a page table entry during a write TLB miss without setting the software-only _PAGE_MODIFIED bit, and the copy-on-write write-protection performed by pte_wrprotect() and pmd_wrprotect() during fork()/clone() then clears _PAGE_DIRTY, so the dirtiness information is lost entirely. A local unprivileged user could exploit this behavior by combining madvise(MADV_FREE), write, and fork operations on private anonymous mappings so that, under memory pressure, page reclaim sees modified pages as clean and frees them without writeback, resulting in data corruption. The Red Hat severity of moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVEORG severity of important (7.1, C:H/I:H/A:N); the two differ primarily in the impact metrics, with Red Hat scoring availability impact only while the CVEORG vector scores confidentiality and integrity. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are marked not affected for this flaw because the LoongArch-specific vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.