{"api_version":"1","generated_at":"2026-08-18T13:35:37+00:00","cve":"CVE-2026-72175","urls":{"html":"https://cve.report/CVE-2026-72175","api":"https://cve.report/api/cve/CVE-2026-72175.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72175","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72175"},"summary":{"title":"fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\n\nPatch series \"userfaultfd/pagemap: pre-existing fixes\".\n\nThese are pre-existing bug fixes that were carried at the front of the\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\nfeedback that fixes should not sit in the middle of a feature series, they\nare split out and sent on their own; the RWP series is reposted rebased on\ntop of this.\n\nAll six were flagged by the Sashiko AI review of the RWP series and carry\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\n\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\n\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\n     against HPAGE_SIZE rather than the hstate page size, so it never\n     write-protects gigantic hugetlb pages.\n\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\n     vma lock for read, and hugetlb_change_protection() then takes it\n     for write. Install the marker inline instead.\n\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\n     on a device-private PMD permission downgrade, silently losing the\n     uffd-wp marker.\n\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\n     PTE without checking pte_present(), so swap/migration entries\n     decode random offset bits and a thread can stay parked on a stale\n     fault.\n\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\n     per-mode masks so an unavailable bit is never materialised.\n\n\nThis patch (of 6):\n\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\nfetched without the corresponding huge_ptep_modify_prot_start().  The\nstart helper is what atomically clears the entry so the kernel-owned\nsnapshot stays consistent until the commit; without it, the hardware may\nset Dirty or Accessed in the live PTE between the original read and the\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\nlive hardware bits, losing the update.\n\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\nfor the present-PTE branch.  The migration case stays as-is -- migration\nentries are non-present, so there's no hardware update to race against.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:35","updated_at":"2026-08-17 06:18:17"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab","name":"https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655","name":"https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4","name":"https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec","name":"https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72175","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72175","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52526ca7fdb905a768a93f8faa418e9b988fc34b 50a25249a6355db74c2c1b6be541b4caab9f3655 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52526ca7fdb905a768a93f8faa418e9b988fc34b 8e39ed92d7c5c6bfc08dc45153916f49a4e98bab git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52526ca7fdb905a768a93f8faa418e9b988fc34b 6b7f774b8882445d9174681747d37c42548686a4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 52526ca7fdb905a768a93f8faa418e9b988fc34b 04718f7c9290f95385f0dd328758753dc1c36dec git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72175","cve":"CVE-2026-72175","epss":"0.001710000","percentile":"0.068720000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/proc/task_mmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"50a25249a6355db74c2c1b6be541b4caab9f3655","status":"affected","version":"52526ca7fdb905a768a93f8faa418e9b988fc34b","versionType":"git"},{"lessThan":"8e39ed92d7c5c6bfc08dc45153916f49a4e98bab","status":"affected","version":"52526ca7fdb905a768a93f8faa418e9b988fc34b","versionType":"git"},{"lessThan":"6b7f774b8882445d9174681747d37c42548686a4","status":"affected","version":"52526ca7fdb905a768a93f8faa418e9b988fc34b","versionType":"git"},{"lessThan":"04718f7c9290f95385f0dd328758753dc1c36dec","status":"affected","version":"52526ca7fdb905a768a93f8faa418e9b988fc34b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/proc/task_mmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\n\nPatch series \"userfaultfd/pagemap: pre-existing fixes\".\n\nThese are pre-existing bug fixes that were carried at the front of the\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\nfeedback that fixes should not sit in the middle of a feature series, they\nare split out and sent on their own; the RWP series is reposted rebased on\ntop of this.\n\nAll six were flagged by the Sashiko AI review of the RWP series and carry\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\n\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\n\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\n     against HPAGE_SIZE rather than the hstate page size, so it never\n     write-protects gigantic hugetlb pages.\n\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\n     vma lock for read, and hugetlb_change_protection() then takes it\n     for write. Install the marker inline instead.\n\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\n     on a device-private PMD permission downgrade, silently losing the\n     uffd-wp marker.\n\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\n     PTE without checking pte_present(), so swap/migration entries\n     decode random offset bits and a thread can stay parked on a stale\n     fault.\n\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\n     per-mode masks so an unavailable bit is never materialised.\n\n\nThis patch (of 6):\n\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\nfetched without the corresponding huge_ptep_modify_prot_start().  The\nstart helper is what atomically clears the entry so the kernel-owned\nsnapshot stays consistent until the commit; without it, the hardware may\nset Dirty or Accessed in the live PTE between the original read and the\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\nlive hardware bits, losing the update.\n\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\nfor the present-PTE branch.  The migration case stays as-is -- migration\nentries are non-present, so there's no hardware update to race against."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the PAGEMAP_SCAN ioctl on /proc/<pid>/pagemap, which requires local access to a process address space and cannot be triggered remotely.\nAC:L - The attacker controls both sides of the race by issuing PAGEMAP_SCAN with PM_SCAN_WP_MATCHING while concurrently writing the same present HugeTLB page from another thread in the target process.\nPR:L - Any unprivileged local user can open /proc/self/pagemap and trigger the ioctl; ptrace read checks also allow same-UID access to another process's pagemap without real root privileges.\nUI:N - No victim user action is required; exploitation is performed entirely by the attacker ioctl-ing pagemap and racing writes against their own or same-UID process mappings.\nS:U - The vulnerability corrupts PTE metadata within the target mm only and does not cross VM, container, or kernel/user security boundaries.\nC:H - Stale HugeTLB PTE commits can clear hardware Dirty/Accessed bits; this PTE corruption can expose stale file-backed data to other mappers or userfaultfd migration consumers instead of current memory contents.\nI:H - Lost Dirty bits break folio dirty tracking and writeback for HugeTLB mappings, allowing silent loss or corruption of in-memory modifications that should have been persisted or migrated.\nA:N - The race corrupts PTE metadata without causing kernel oops, panic, or hang; availability impact is limited to incorrect page state rather than system crash."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:41:11.530Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655"},{"url":"https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab"},{"url":"https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4"},{"url":"https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec"}],"title":"fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72175","datePublished":"2026-08-15T05:53:40.011Z","dateReserved":"2026-08-09T03:40:39.910Z","dateUpdated":"2026-08-17T05:41:11.530Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:35","lastModifiedDate":"2026-08-17 06:18:17","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72175","Ordinal":"1","Title":"fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race","CVE":"CVE-2026-72175","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72175","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\n\nPatch series \"userfaultfd/pagemap: pre-existing fixes\".\n\nThese are pre-existing bug fixes that were carried at the front of the\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\nfeedback that fixes should not sit in the middle of a feature series, they\nare split out and sent on their own; the RWP series is reposted rebased on\ntop of this.\n\nAll six were flagged by the Sashiko AI review of the RWP series and carry\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\n\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\n\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\n     against HPAGE_SIZE rather than the hstate page size, so it never\n     write-protects gigantic hugetlb pages.\n\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\n     vma lock for read, and hugetlb_change_protection() then takes it\n     for write. Install the marker inline instead.\n\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\n     on a device-private PMD permission downgrade, silently losing the\n     uffd-wp marker.\n\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\n     PTE without checking pte_present(), so swap/migration entries\n     decode random offset bits and a thread can stay parked on a stale\n     fault.\n\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\n     per-mode masks so an unavailable bit is never materialised.\n\n\nThis patch (of 6):\n\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\nfetched without the corresponding huge_ptep_modify_prot_start().  The\nstart helper is what atomically clears the entry so the kernel-owned\nsnapshot stays consistent until the commit; without it, the hardware may\nset Dirty or Accessed in the live PTE between the original read and the\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\nlive hardware bits, losing the update.\n\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\nfor the present-PTE branch.  The migration case stays as-is -- migration\nentries are non-present, so there's no hardware update to race against.","Type":"Description","Title":"fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race"}]}}}