CVE-2026-68086

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/khugepaged: write all dirty file folios when collapsing<br /> <br /> [There is no upstream commit, as this code was removed by upstream<br /> commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")]<br /> <br /> As-is, khugepaged and writable-file opening exclude each other. A file<br /> cannot be open writeable and have THPs (because the filesystem is not aware<br /> of them). khugepaged will never collapse file pages for files that are<br /> opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that<br /> particular file is dropped. This is fine because nothing could&amp;#39;ve been<br /> dirtied.<br /> <br /> However, there is an edge-case: collapse_file() might not be able to<br /> coexist with concurrent writers, but it can coexist with dirty folios<br /> (from previous writers). Therefore, the following can happen:<br /> <br /> open(file, O_RDWR)<br /> write(file)<br /> close(file)<br /> madvise(file_mapping, MADV_COLLAPSE, some non-dirty range)<br /> open(file, O_RDWR)<br /> nr_thps &gt; 0<br /> truncate_inode_pages()<br /> /* THPs are cleared out, but so are the dirty folios */<br /> <br /> When this edge-case happens, there is data loss, as the dirty folios are<br /> fully discarded.<br /> <br /> Fix it by fully writing back the page cache (and waiting) when collapsing<br /> file THPs. Doing so provides the guarantee that no dirty folio will be<br /> observed while there are active THPs. To fully ensure this is safe, the<br /> invalidate_lock needs to be held while doing the writeout, so that<br /> do_dentry_open()&amp;#39;s page cache truncation excludes this write-and-wait.<br /> <br /> As a side effect, move the nr_thps counter bumping outside the i_pages<br /> lock. This is correct since the counter itself is an atomic_t and the<br /> producer consumer correctness is provided by a full memory barrier:<br /> smp_mb() in collapse_file()/memory barrier implied by full ordering in<br /> get_write_access() -&gt; atomic_inc_unless_negative().