CVE-2026-53109 Overview
CVE-2026-53109 is a Linux kernel vulnerability in the powerpc architecture's page table fragment management code. The flaw resides in pte_frag_destroy() within arch/powerpc/mm/pgtable-frag.c, where a folio's active flag is not cleared before the page is freed during process exit. When a cached PTE fragment folio is released through the do_exit() path while still carrying the active flag, the kernel triggers a Bad page state error via PAGE_FLAGS_CHECK_AT_FREE. The bug surfaces on Hash MMU configurations using 64K page size, where 16 PTE fragments of 4K each share a single 64K folio.
Critical Impact
A local process exit on powerpc systems can trigger kernel Bad page state errors, corrupting page accounting and risking memory management instability.
Affected Products
- Linux kernel on powerpc architecture (Hash MMU with 64K pages)
- Linux kernel builds prior to commits a32db6fc, c8b71065, and fda4d716
- IBM pSeries and POWER platforms running affected kernels
Discovery Timeline
- 2026-06-24 - CVE-2026-53109 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53109
Vulnerability Analysis
The powerpc memory subsystem uses pt_frag_refcount to track PTE and PMD page table fragments allocated from a shared folio. On Hash MMU with 64K page size, one folio contains 16 fragments of 4K each. The patch series "mm: free retracted page table by RCU" introduced pte_free_defer() to defer freeing of PTE tables when retract_page_tables() runs for madvise(MADV_COLLAPSE) on shmem ranges. pte_free_defer() sets the folio's active flag and calls pte_fragment_free(), which decrements pt_frag_refcount. When the refcount reaches zero, the active flag determines whether the folio is freed via call_rcu() or pte_free_now().
Root Cause
A race exists between fragment lifecycle management and process teardown. If a PTE fragment was allocated from a folio that still retains the active flag from a prior pte_free_defer() call, and the owning process exits while caching that folio as mm->context.pte_frag, pte_frag_destroy() invokes pagetable_dtor() and pagetable_free() without clearing the active flag. The frozen page allocator then detects the lingering PG_active flag during __free_frozen_pages() and triggers the bad_page() report.
Attack Vector
The vulnerability is reachable through the standard process exit path on affected powerpc kernels. A local user running a workload that exercises madvise(MADV_COLLAPSE) on shmem mappings, then terminates, can drive the corner case. The reported call trace shows the failure path: system_call_vectored_common → do_exit → exit_mmap → arch_exit_mmap → pte_frag_destroy → __free_frozen_pages → bad_page. Exploitation requires local code execution and the specific Hash MMU 64K configuration. The vendor fix clears the folio active flag in pte_frag_destroy() before calling pagetable_dtor() and pagetable_free() when the refcount is zero.
Detection Methods for CVE-2026-53109
Indicators of Compromise
- Kernel log entries containing BUG: Bad page state in process originating from pte_frag_destroy+
- PAGE_FLAGS_CHECK_AT_FREE flag(s) set messages with the active flag visible in the page dump
- Call traces showing arch_exit_mmap → pte_frag_destroy → __free_frozen_pages → bad_page on powerpc hosts
Detection Strategies
- Parse dmesg and /var/log/messages for bad_page reports referencing powerpc page table teardown functions
- Correlate process exit events with kernel BUG reports to identify workloads using madvise(MADV_COLLAPSE) on shmem
- Track kernel version inventory across powerpc fleets to flag hosts running unpatched builds
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized log pipeline and alert on Bad page state patterns
- Monitor process crash counts on IBM POWER hosts running Hash MMU 64K configurations
- Audit kernel build metadata against the fixing commits a32db6fca3c7, c8b710655012, and fda4d71651f7
How to Mitigate CVE-2026-53109
Immediate Actions Required
- Apply the upstream Linux kernel patches that clear the folio active flag inside pte_frag_destroy() before page table destructor and free calls
- Inventory powerpc systems using Hash MMU with 64K page size and prioritize them for patching
- Reboot affected hosts after kernel updates to ensure the fixed code path is active
Patch Information
The fix has been merged into the Linux stable tree across three commits: a32db6fca3c7, c8b710655012, and fda4d71651f7. The patch clears the folio active flag before invoking pagetable_dtor() and pagetable_free() when pt_frag_refcount reaches zero during pte_frag_destroy(). Distribution maintainers should backport these commits to supported kernel branches.
Workarounds
- Switch powerpc systems to Radix MMU where feasible, as the issue is specific to Hash MMU 64K configurations
- Avoid workloads that rely on madvise(MADV_COLLAPSE) against shmem mappings on unpatched kernels
- Restrict untrusted local execution on affected hosts until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
