CVE-2026-31648: Linux Kernel Race Condition Vulnerability

CVE-2026-31648 Overview

CVE-2026-31648 is an integer overflow vulnerability [CWE-190] in the Linux kernel's memory management subsystem, specifically within the filemap_map_pages() function in mm/filemap.c. The flaw stems from a race condition between page fault handling and file truncation via ext4_setattr(). When an inode size shrinks concurrently with page fault processing, the nr_pages calculation can overflow, causing set_pte_range() to map pages beyond a large folio's boundary. This results in memory corruption affecting page descriptors outside the intended folio, manifesting as "Bad page state" kernel panics and corrupted page->_mapcount fields.

Critical Impact
A local attacker with low privileges can trigger memory corruption in the kernel page cache, leading to system instability, denial of service, or potential privilege escalation through corrupted page metadata.

Affected Products

Linux Kernel 6.12 (initial release)
Linux Kernel 7.0 release candidates (rc1 through rc7)
Earlier stable branches receiving the backported regression

Discovery Timeline

2026-04-24 - CVE-2026-31648 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31648

Vulnerability Analysis

The vulnerability was discovered while running stress-ng on an Arm64 system with the v7.0-rc3 kernel. The filemap_map_pages() function is responsible for mapping file-backed pages into a process's page tables during fault-around operations. The function calculates how many pages can be mapped from the current folio using the expression nr_pages = min(end, end_pgoff) - xas.xa_index + 1.

When a concurrent ext4_setattr() call shrinks the inode size, the subsequent recalculation of end_pgoff based on the new i_size can produce a value smaller than xas.xa_index. The unsigned subtraction then wraps around, producing a large positive nr_pages value. The kernel then calls filemap_map_folio_range() with this overflowed count, causing set_pte_range() to establish PTEs for memory beyond the folio's actual boundary.

Root Cause

The root cause is an unsynchronized read of inode->i_size between folio acquisition in next_uptodate_folio() and the end_pgoff calculation. The folio is locked with an older view of the file size, while end_pgoff is computed using a newer, smaller size after concurrent truncation. The unsigned arithmetic in nr_pages calculation does not validate that the end index exceeds the start index, permitting integer overflow.

Attack Vector

Exploitation requires local access with the ability to execute code and issue memory-mapped file operations. An attacker creates a workload that simultaneously maps a file and triggers truncation through truncate() or ftruncate() system calls from another thread. The race window is narrow but reliably reproducible under memory pressure with large folios enabled. The resulting memory corruption can damage adjacent page descriptors, potentially leading to use-after-free conditions or invalid mapping states.

The vulnerability is described in prose only as no verified public proof-of-concept exists. Reproduction details are available in the upstream commit messages referenced in the Kernel Git Commit 9316a82.

Detection Methods for CVE-2026-31648

Indicators of Compromise

Kernel log entries containing BUG: Bad page state in process messages referencing nonzero mapcount with zero refcount
VM_WARN_ON_FOLIO warnings originating from folio_add_file_rmap_ptes in include/linux/rmap.h
Call traces involving filemap_map_folio_range, filemap_map_pages, and do_fault_around immediately preceding crashes
Unexpected system instability during workloads combining heavy mmap activity with file truncation

Detection Strategies

Enable CONFIG_DEBUG_VM in test environments to surface folio boundary violations before they cause corruption
Monitor dmesg and /var/log/kern.log for page state warnings tied to large folio file-backed mappings
Audit running kernel versions against the patched commits across the fleet to identify exposed hosts
Use behavioral telemetry from EDR agents to flag processes generating unusual kernel oops or panic events

Monitoring Recommendations

Aggregate kernel ring buffer messages into a centralized logging pipeline for anomaly detection
Track stress patterns such as repeated mmap() plus ftruncate() syscall sequences from unprivileged processes
Alert on kernel panics or Bad page state strings appearing in production telemetry
Correlate process-level syscall activity with kernel warnings to identify potential exploitation attempts

How to Mitigate CVE-2026-31648

Immediate Actions Required

Apply the upstream patches referenced in the kernel stable tree as soon as distribution updates are available
Inventory Linux hosts running kernel 6.12 or 7.0-rc series and prioritize patching for systems exposed to untrusted local users
Restrict local shell access on multi-tenant systems until patched kernels are deployed
Disable large folio support for file-backed mappings on vulnerable kernels where workload tolerates it

Patch Information

The fix moves the end_pgoff calculation before next_uptodate_folio() so the retrieved folio remains consistent with the file end value used for boundary calculations. Patches are available in the following kernel stable commits: Kernel Git Commit 576543b, Kernel Git Commit 633ab6b, Kernel Git Commit 8859119, Kernel Git Commit 9316a82, and Kernel Git Commit f58df56.

Workarounds

Reduce concurrent mmap and truncate workloads on shared systems where patching is delayed
Apply strict process isolation using containers or namespaces to limit which users can trigger the race
Tune transparent_hugepage and large folio settings to reduce exposure surface for file-backed faults
Monitor and reboot systems exhibiting Bad page state warnings to prevent cascading corruption

bash

# Verify kernel version and check for fixed commits
uname -r

# Check if running an affected kernel series
if uname -r | grep -qE '^(6\.12|7\.0-rc)'; then
    echo "WARNING: Kernel may be vulnerable to CVE-2026-31648"
    echo "Apply distribution updates or backported patches"
fi

# Inspect kernel logs for indicators
dmesg | grep -E 'Bad page state|VM_WARN_ON_FOLIO|filemap_map'