CVE-2026-74632

A flaw was found in the Linux kernel's memory management (mm/huge_memory). A race condition can occur between a memory shrinker and a concurrent page fault when handling huge zero pages. This race can lead to the huge_zero_pfn being incorrectly set, causing the huge zero page to be misidentified as an ordinary Transparent Huge Page (THP) folio. Consequently, the huge zero page may be incorrectly split or otherwise mishandled, potentially leading to system instability or unexpected memory behavior.

A moderate impact race condition was found in the Linux kernel's transparent huge page (THP) huge zero page handling (mm/huge_memory). When the kernel is built without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, a memory shrinker dropping the final reference on the huge zero folio can race with a concurrent page fault that installs a new huge zero folio: if the shrinker is preempted between setting huge_zero_refcount to zero and writing the ~0UL sentinel, get_huge_zero_folio() can install a valid huge_zero_folio and huge_zero_pfn which the shrinker then overwrites. In that state is_huge_zero_pfn() and is_huge_zero_pmd() misidentify the huge zero folio as an ordinary THP folio, and the folio can subsequently be split or otherwise mishandled. A local unprivileged user can plausibly participate in the page-fault side of the race, but triggering the flaw requires winning a narrow timing window under memory pressure; the verified consequence is system instability or a kernel crash (denial of service), with no demonstrated confidentiality or integrity impact. The kernel packages in Red Hat Enterprise Linux 8, 9 and 10 (kernel and kernel-rt) and in Red Hat In-Vehicle OS are affected; RHEL 6, RHEL 7 ELS, and RHEL 8.4 are not affected because the vulnerable code is not present there. Fixes for the affected streams are currently deferred to future maintenance updates, so the residual risk of a low-probability crash remains until the fix is shipped. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG rating of Important (7.8), because Red Hat assesses the impact as availability-only and the race is difficult to trigger reliably.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.