CVE-2026-89987

A flaw was found in the Linux kernel's huge memory management. This vulnerability can lead to silent data loss for applications utilizing shared memory segments (MAP_SHARED tmpfs) when Transparent Huge Pages (THP) and swap are active. The system fails to correctly mark modified memory as 'dirty,' causing it to be discarded instead of being written to swap when the memory is unmapped. This can result in the unexpected loss of application data.

A data integrity flaw in the Linux huge PMD zap path can lose writes to MAP_SHARED tmpfs mappings when shmem THP is enabled and swap backed reclaim later removes the folio. The PMD dirty bit can be the only record that the 2MB folio was written after a read fault installed a writable PMD, but zap_huge_pmd_folio did not transfer that dirty state to the folio before unmapping. A local process can trigger the affected path by using a shared tmpfs mapping under the required configuration and causing unmap or process exit followed by reclaim. For the CVSS the PR:L is used because local user level code is required to create and access the mapping, while administrator setup may be needed to enable shmem THP or the relevant mount mode. The issue is not network reachable. Impact is silent data loss and integrity loss for affected tmpfs data, with possible application disruption, but there is no evidence of memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.