CVE-2026-64181

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()<br /> <br /> On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a<br /> "WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the<br /> VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by<br /> "BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when<br /> reclaim gets to call shrink_huge_zero_folio_scan().<br /> <br /> It&amp;#39;s as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and<br /> indeed, whereas pte_special() and pte_mkspecial() are subject to a<br /> dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial()<br /> are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on<br /> any 32-bit architecture.<br /> <br /> While the problem was exposed through commit d80a9cb1a64a<br /> ("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an<br /> oversight in commit af38538801c6 ("mm/memory: factor out common code from<br /> vm_normal_page_*()") and would result in other problems:<br /> * huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and<br /> numamaps as file-backed THP<br /> * folio_walk_start() returning the folio even without FW_ZEROPAGE set.<br /> Callers seem to tolerate that, though.<br /> <br /> ... and triggering the VM_WARN_ON_ONE(), although never reported so far.<br /> <br /> To fix it, teach vm_normal_page_pmd()/vm_normal_page_pud() to consider<br /> whether pmd_special/pud_special is actually implemented.