CVE-2026-72180

A flaw was found in the Linux kernel's huge memory management (mm/huge_memory). When a device-private Page Middle Directory (PMD) is downgraded, the pmd_swp_uffd_wp bit, which indicates Userfault File Descriptor Write Protect (UFFD_WP), is not properly preserved. This oversight allows a local attacker to bypass write protection mechanisms by performing an mprotect() operation over a UFFD_WP-marked device-private Transparent Huge Page (THP), potentially leading to unauthorized memory modifications.

This vulnerability is assessed as Moderate severity because exploitation requires an authenticated local user to manipulate userfaultfd write-protection mappings on device-private memory, preventing remote compromise. The flaw cannot lead to arbitrary privilege escalation on its own and is limited in blast radius to local memory state inconsistency. Supported Red Hat Enterprise Linux releases are not affected, as the vulnerable code paths are not present in our shipping kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.