CVE-2026-97945

A flaw was found in the Linux kernel. A local user can cause silent data loss or data corruption due to improper memory tracking in the x86 memory management subsystem. When modifying permissions on transparent huge pages (a mechanism that optimizes memory by grouping it into larger blocks), the kernel inadvertently discards the tracking flag that marks memory as modified. Under memory pressure, the system treats this modified memory as clean and discards it, leading to permanent data loss for user-space applications or failing to write updates back to disk.

A moderate impact flaw was found in the Linux kernel x86 memory management subsystem affecting Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later streams based on the RHEL 9 CoreOS kernel. When page permissions of a PMD-mapped transparent huge page are modified, for example by mprotect() or NUMA hinting faults, the pmd_modify() function silently discards the hardware dirty bit from the page table entry. If an application rewrites memory that was previously marked for lazy reclaim with madvise(MADV_FREE), the kernel no longer considers the page dirty, and under memory reclaim pressure the folio can be discarded and replaced with zeroed pages, causing silent and permanent loss of user-space data. PMD-mapped file-backed transparent huge pages are also affected because rewritten data may never be written back to disk. A local unprivileged user can trigger this issue through the combination of transparent huge pages, MADV_FREE or file-backed huge pages, and heavy memory pressure, causing availability impact through silent data loss. Red Hat Enterprise Linux 7 and 8, including their real-time kernels, the RHEL 9.2 and 9.4 update streams, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present in those kernels; Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. The fix is currently deferred for the affected streams, as the upstream correction that preserves the dirty bit in the pmd_modify() mask has not yet been included in the affected Red Hat kernel updates. Until a fixed kernel is released, the residual risk is silent data loss or failure to write file updates back to disk for workloads that use PMD-mapped transparent huge pages together with MADV_FREE, mprotect(), or NUMA balancing under memory pressure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.