In the Linux kernel, the following vulnerability has been resolved:
mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can
trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock
when racing with a concurrent unmap:
thread#0 thread#1
-------- --------
madvise(folio, MADV_HWPOISON)
-> poisons the folio successfully
madvise(folio, MADV_HWPOISON) unmap(folio)
try_memory_failure_hugetlb
get_huge_page_for_hwpoison
spin_lock_irq(&hugetlb_lock) <- held
__get_huge_page_for_hwpoison
hugetlb_update_hwpoison()
-> MF_HUGETLB_FOLIO_PRE_POISONED
goto out:
folio_put()
refcount: 1 -> 0
free_huge_folio()
spin_lock_irqsave(&hugetlb_lock)
-> AA DEADLOCK!
The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop
the GUP reference while the hugetlb_lock is still held by the hugetlb.c
wrapper get_huge_page_for_hwpoison(). If concurrent unmap has released
the page table mapping reference, folio_put() drops the folio refcount to
zero, triggering free_huge_folio() which attempts to re-acquire the
non-recursive hugetlb_lock.
Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper
into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the
folio_put() at the out: label so the folio is always released outside the
lock.
[akpm@linux-foundation.org: fix race, rename label per Miaohe]
References
Configurations
Configuration 1 (hide)
|
History
02 Jul 2026, 20:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-667 | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e - Patch | |
| References | () https://git.kernel.org/stable/c/77b73b54801ae7137479c141fd0473a491c1dc48 - Patch | |
| References | () https://git.kernel.org/stable/c/a33bfed648c10f5a1519981dbfad80841191edc8 - Patch | |
| References | () https://git.kernel.org/stable/c/bf7ba8f96c258c30393814491930ae4ecdc5fe5e - Patch | |
| References | () https://git.kernel.org/stable/c/dd77a83915b07e2b0205adb284f08b39ae31dc4b - Patch | |
| References | () https://git.kernel.org/stable/c/fc3ff42cb0cbf947e4600ae9761c3783760050e2 - Patch |
25 Jun 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 09:16
Updated : 2026-07-02 20:55
NVD link : CVE-2026-53207
Mitre link : CVE-2026-53207
CVE.ORG link : CVE-2026-53207
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-667
Improper Locking