CVE-2026-31456

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/pagewalk: fix race between concurrent split and refault<br /> <br /> The splitting of a PUD entry in walk_pud_range() can race with a<br /> concurrent thread refaulting the PUD leaf entry causing it to try walking<br /> a PMD range that has disappeared.<br /> <br /> An example and reproduction of this is to try reading numa_maps of a<br /> process while VFIO-PCI is setting up DMA (specifically the<br /> vfio_pin_pages_remote call) on a large BAR for that process.<br /> <br /> This will trigger a kernel BUG:<br /> vfio-pci 0000:03:00.0: enabling device (0000 -&gt; 0002)<br /> BUG: unable to handle page fault for address: ffffa23980000000<br /> PGD 0 P4D 0<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> ...<br /> RIP: 0010:walk_pgd_range+0x3b5/0x7a0<br /> Code: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24<br /> 28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 f7 06<br /> 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74<br /> RSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287<br /> RAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff<br /> RDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0<br /> RBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000<br /> R10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000<br /> R13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000<br /> FS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000)<br /> knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> __walk_page_range+0x195/0x1b0<br /> walk_page_vma+0x62/0xc0<br /> show_numa_map+0x12b/0x3b0<br /> seq_read_iter+0x297/0x440<br /> seq_read+0x11d/0x140<br /> vfs_read+0xc2/0x340<br /> ksys_read+0x5f/0xe0<br /> do_syscall_64+0x68/0x130<br /> ? get_page_from_freelist+0x5c2/0x17e0<br /> ? mas_store_prealloc+0x17e/0x360<br /> ? vma_set_page_prot+0x4c/0xa0<br /> ? __alloc_pages_noprof+0x14e/0x2d0<br /> ? __mod_memcg_lruvec_state+0x8d/0x140<br /> ? __lruvec_stat_mod_folio+0x76/0xb0<br /> ? __folio_mod_stat+0x26/0x80<br /> ? do_anonymous_page+0x705/0x900<br /> ? __handle_mm_fault+0xa8d/0x1000<br /> ? __count_memcg_events+0x53/0xf0<br /> ? handle_mm_fault+0xa5/0x360<br /> ? do_user_addr_fault+0x342/0x640<br /> ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0<br /> ? irqentry_exit_to_user_mode+0x24/0x100<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7fe88464f47e<br /> Code: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f<br /> 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 3d 00<br /> f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28<br /> RSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000<br /> RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e<br /> RDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003<br /> RBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000<br /> R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000<br /> R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000<br /> <br /> <br /> Fix this by validating the PUD entry in walk_pmd_range() using a stable<br /> snapshot (pudp_get()). If the PUD is not present or is a leaf, retry the<br /> walk via ACTION_AGAIN instead of descending further. This mirrors the<br /> retry logic in walk_pte_range(), which lets walk_pmd_range() retry if the<br /> PTE is not being got by pte_offset_map_lock().