CVE-2026-46013: Linux Kernel Privilege Escalation Flaw

CVE-2026-46013 Overview

CVE-2026-46013 is a Linux kernel vulnerability in the mm/memfd_luo memory management subsystem. The flaw resides in the memfd_luo_retrieve_folios() function's put_folios cleanup path. The cleanup path incorrectly passes a raw Page Frame Number (PFN) to kho_restore_folio(), which expects a phys_addr_t physical address. The function then validates the wrong physical address by shifting the PFN again with pfn << PAGE_SHIFT. The cleanup loop also omits the !pfolio->pfn check present in the main retrieval loop and in memfd_luo_discard_folios(). The maintainers resolved the issue with kernel commits 3538f90 and bd0d6bd.

Critical Impact
Incorrect physical address conversion in kernel memory folio cleanup can lead to validation against an invalid memory range and unsafe processing of sparse file holes where pfn=0.

Affected Products

Linux kernel mm/memfd_luo memory management subsystem
Kernel builds containing the memfd_luo_retrieve_folios() cleanup path
Distributions tracking mainline kernel prior to commits 3538f90ab89a and bd0d6bde286a

Discovery Timeline

2026-05-27 - CVE-2026-46013 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46013

Vulnerability Analysis

The vulnerability lives in memfd_luo_retrieve_folios(), a function used for retrieving folios in the Linux kernel's memory file descriptor live-update (LUO) path. The cleanup routine put_folios is responsible for releasing folio references when retrieval fails or completes. The cleanup path calls kho_restore_folio() with the wrong argument type. The function expects a phys_addr_t value, but the caller supplies the raw PFN stored in pfolio->pfn. Internally, kho_restore_page() then applies an additional PAGE_SHIFT, resulting in validation against an address that does not correspond to the intended physical page. The second defect is the missing guard for sparse file holes. Other call sites such as the main retrieval loop and memfd_luo_discard_folios() skip entries where pfolio->pfn is zero. The cleanup path lacked this check and could operate on entries representing holes rather than real backing pages.

Root Cause

The root cause is a type and unit mismatch between the producer and the consumer of the address value [CWE-704 style conversion error]. The cleanup path treats a PFN as if it were a physical address. The fix wraps the PFN with the PFN_PHYS() macro and adds the !pfolio->pfn guard so the loop matches the convention used elsewhere in the file.

Attack Vector

This is a local kernel-resident issue reachable through the memfd LUO retrieval code path. The CVE record does not assign a CVSS score, attack vector, or known exploitation status. No public proof-of-concept, exploit, or CISA KEV listing is associated with this CVE. The patch metadata indicates the issue was identified by an AI-assisted code review and corrected before broad distribution.

No verified exploitation code is available for this CVE. Refer to the upstream commits for the exact source-level fix.

Detection Methods for CVE-2026-46013

Indicators of Compromise

No runtime indicators of compromise have been published for CVE-2026-46013, as the defect is a kernel memory-management correctness bug rather than a known exploited vulnerability.
Kernel logs referencing kho_restore_folio or memfd_luo_retrieve_folios faults on systems running unpatched kernels warrant investigation.

Detection Strategies

Inventory running kernel versions and compare against the fixed commits 3538f90ab89aaf302782b4b073a0aae66904cd67 and bd0d6bde286a2b8e3ae7975b0dcc2d43875d5fc9.
Audit configuration management data to identify Linux hosts that build or ship the memfd_luo code path without the upstream fix.
Monitor kernel crash dumps and dmesg output for anomalous folio restore failures on hosts using memfd live-update functionality.

Monitoring Recommendations

Track distribution security advisories that reference the upstream stable commits for backports into long-term support kernels.
Use endpoint telemetry to record kernel build identifiers across the Linux fleet so patched and unpatched hosts can be distinguished.
Alert on unexpected kernel oops or panic events on systems exercising the memfd LUO retrieval path.

How to Mitigate CVE-2026-46013

Immediate Actions Required

Apply the upstream kernel patches referenced by commits Kernel Git Commit 3538f90 and Kernel Git Commit bd0d6bd.
Rebuild and redeploy custom kernels that include the mm/memfd_luo subsystem.
Coordinate with Linux distribution vendors to confirm that stable backports cover the affected kernel branches.

Patch Information

The fix converts the PFN to a physical address using the PFN_PHYS() macro before passing it to kho_restore_folio() and adds the !pfolio->pfn check to skip sparse file holes. Both changes appear in the upstream commits 3538f90ab89a and bd0d6bde286a on git.kernel.org.

Workarounds

No officially documented workaround exists; applying the upstream patch is the supported remediation.
Where patching is delayed, restrict use of memfd live-update functionality on affected hosts until a fixed kernel is deployed.
Validate that container and virtualization platforms relying on memfd-backed memory run on patched kernel builds before resuming production workloads.

bash

# Verify the running kernel includes the fix commits
uname -r
zcat /proc/config.gz | grep -i memfd
git -C /usr/src/linux log --oneline | grep -E '3538f90|bd0d6bd'