CVE-2026-53155: Linux Kernel Privilege Escalation Flaw

CVE-2026-53155 Overview

CVE-2026-53155 affects the Linux kernel's transparent huge page (THP) memory management subsystem. The flaw exists in set_pmd_migration_entry() within mm/huge_memory, where the function incorrectly references PMD entry fields when establishing device-private migration entries. The function uses pmd_write(), pmd_soft_dirty(), and pmd_uffd_wp() against softleaf entries instead of the appropriate softleaf accessors. On x86-64, _PAGE_SWP_SOFT_DIRTY aliases _PAGE_RW, causing the softdirty bit to be misread as the writable bit. The result is corrupted reverse mapping (rmap) state and triggered kernel warnings during device-private THP migration scenarios.

Critical Impact
Misinterpretation of PMD flag bits leads to AnonExclusive folios with entire_mapcount > 1, corrupting rmap state and tripping VM_WARN_ON_FOLIO assertions in __folio_add_anon_rmap().

Affected Products

Linux kernel versions containing commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device-private entries")
Linux kernel builds with CONFIG_MEM_SOFT_DIRTY enabled on x86-64
Systems exercising device-private THP migration paths (HMM, heterogeneous memory)

Discovery Timeline

2026-06-25 - CVE-2026-53155 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53155

Vulnerability Analysis

The defect resides in set_pmd_migration_entry() after commit 65edfda6f3f2 switched the softleaf path to use pmdp_huge_get_and_clear() without updating downstream flag inspection logic. The function continues to call pmd_write(), pmd_soft_dirty(), and pmd_uffd_wp() on a value that already represents a softleaf migration entry. These accessors decode bits that are valid only for present PMDs, returning meaningless or aliased values for swap-format entries.

The most consequential aliasing occurs on x86-64, where _PAGE_SWP_SOFT_DIRTY overlaps _PAGE_RW. A softleaf entry with the softdirty bit set will be reported as writable by pmd_write(), causing the migration entry to be marked writable when it should remain read-only. The fix replaces these accessors with softleaf-specific field readers and restricts A/D flag updates to entries that are actually present.

Root Cause

The root cause is improper input validation of PMD entry state combined with bit aliasing in the x86-64 page table encoding. The function does not distinguish between present PMDs and softleaf migration entries when reading writable, softdirty, and userfaultfd-wp flags, leading to a kernel-level memory management logic flaw.

Attack Vector

The issue is reachable through device-private THP migration workflows. The hmm.hmm_device_private.anon_write_child selftest reproduces the sequence: the parent migrates a range to a device-private writable PMD, forks to create read-only entries with softdirty set, then the child writes and triggers migration back to RAM. The kernel installs writable migration entries due to the softdirty/writable bit alias, sets RMAP_EXCLUSIVE for both parent and child folios in remove_migration_pmd(), and produces an AnonExclusive folio with entire_mapcount=2. The assertion in __folio_add_anon_rmap() then fires.

No verified exploit code is available. Refer to the upstream commits for technical details: Kernel.org commit 43e7f189769c and Kernel.org commit d7251c8d3f7c.

Detection Methods for CVE-2026-53155

Indicators of Compromise

Kernel warning splats referencing VM_WARN_ON_FOLIO in __folio_add_anon_rmap() with folio_entire_mapcount(folio) > 1 and PageAnonExclusive set.
Unexpected entire_mapcount values on AnonExclusive THP folios surfaced through /proc/kpageflags inspection.
Workloads using HMM device-private migration (GPU compute, accelerator memory) producing rmap corruption messages in dmesg.

Detection Strategies

Audit running kernel versions against the patched commits 43e7f189769c and d7251c8d3f7c on stable branches.
Monitor kernel logs for rmap-related warnings, particularly on hosts running accelerator workloads with CONFIG_TRANSPARENT_HUGEPAGE and CONFIG_MEM_SOFT_DIRTY enabled.
Run the upstream hmm.hmm_device_private.anon_write_child selftest in a controlled environment to confirm patch effectiveness.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log aggregator and alert on VM_WARN_ON_FOLIO or BUG strings.
Track host stability metrics (oops counts, soft lockup events) on systems using HMM, CUDA Unified Memory, or ROCm.
Establish a kernel build inventory mapping each host to its mm/huge_memory patch level.

How to Mitigate CVE-2026-53155

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 43e7f189769c and d7251c8d3f7c.
Identify hosts running HMM or device-private memory workloads and prioritize them for patching.
Coordinate with distribution vendors to confirm backport availability for long-term support kernels.

Patch Information

The fix updates set_pmd_migration_entry() to read writable, softdirty, and uffd-wp state from the softleaf entry fields rather than from PMD accessors. It restricts accessed/dirty flag updates to present entries and restructures the present/non-present branching for clarity. Patches are available at Kernel.org commit 43e7f189769c and Kernel.org commit d7251c8d3f7c.

Workarounds

Disable transparent huge pages on affected systems by setting /sys/kernel/mm/transparent_hugepage/enabled to never where device-private migration is in use.
Disable CONFIG_MEM_SOFT_DIRTY in custom kernel builds if soft-dirty tracking is not required, removing the bit aliasing on x86-64.
Avoid running workloads that exercise device-private THP migration paths until the patch is deployed.

bash

# Disable transparent huge pages as a temporary mitigation
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/defrag

# Verify patched kernel is running
uname -r