CVE-2026-80893

A flaw was found in the Linux kernel's huge page (hugetlb) memory management. A local user could trigger a memory corruption vulnerability during a process duplication (fork()) operation. This occurs when the kernel incorrectly clears a specific bit in swap entries for huge pages, leading to the corruption of memory entries copied into the child process. While the immediate impact may be latent, this corruption can propagate and potentially lead to system instability or unexpected behavior.

A hugetlb swap entry corruption can occur during fork() because copy_hugetlb_page_range() used huge_pte_clear_uffd_wp() on migration and hwpoison entries. That helper clears the present PTE bit position, while swap entries store uffd-wp state elsewhere, so the operation can corrupt the encoded swap offset or PFN copied into the child process. No userfaultfd registration is required because the condition depends on the child VMA not being uffd-wp registered and on an in-flight hugetlb migration entry or a hwpoison entry. For the CVSS the PR:L is used for the paranoid score because a local user context can trigger fork() on its own mappings, although reliable triggering depends on hugetlb availability and migration or hwpoison timing. The issue is not network reachable. Impact is at least a local denial of service or corrupted memory mapping state and in worst case may allow confidentiality or integrity impact due to memory-management entry corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.