CVE-2026-64181: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64181 Overview

CVE-2026-64181 is a Linux kernel vulnerability in the memory management subsystem. The flaw affects __vm_normal_page() handling when architectures lack support for pmd_special() and pud_special(). On x86 32-bit systems with Transparent Huge Pages (THP) enabled, zap_huge_pmd() triggers a kernel warning followed by BUG: Bad rss-counter state and BUG: Bad page state errors during reclaim in shrink_huge_zero_folio_scan().

The issue stems from CONFIG_ARCH_SUPPORTS_PMD_PFNMAP never being enabled on 32-bit architectures, leaving the _PAGE_SPECIAL bit unset in the huge zero pmd. This produces incorrect accounting of huge zero folios in smaps, pagemap, and numamaps.

Critical Impact
Local attackers with low privileges can trigger kernel state corruption, resulting in denial of service and potential memory integrity failures on affected 32-bit systems.

Affected Products

Linux kernel with Transparent Huge Pages (THP) enabled
Architectures without CONFIG_ARCH_SUPPORTS_PMD_PFNMAP (including x86 32-bit)
Kernel builds affected by commit af38538801c6 and exposed by d80a9cb1a64a

Discovery Timeline

2026-07-19 - CVE-2026-64181 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64181

Vulnerability Analysis

The vulnerability resides in the kernel's virtual memory subsystem, specifically in __vm_normal_page() and its pmd/pud variants. When the architecture lacks support for pmd_special() and pud_special(), the huge zero folio's special bit is never propagated. The kernel then treats the huge zero page as a normal folio, breaking rss accounting and folio walk semantics.

On x86 32-bit systems with THP enabled, zap_huge_pmd() produces a VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)) warning at mm/memory.c:735. Subsequent reclaim through shrink_huge_zero_folio_scan() generates Bad rss-counter state and Bad page state errors, indicating internal kernel accounting corruption.

Root Cause

While pte_special() and pte_mkspecial() are controlled by CONFIG_ARCH_HAS_PTE_SPECIAL, their pmd and pud counterparts are gated by CONFIG_ARCH_SUPPORTS_PMD_PFNMAP. This config is never enabled on any 32-bit architecture. Commit af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") failed to account for this asymmetry, and commit d80a9cb1a64a later exposed the defect.

Attack Vector

A local unprivileged user can trigger the code path by allocating memory under THP on affected 32-bit kernels. Normal workloads exercising huge zero folios reach the faulty accounting logic, producing kernel warnings, corrupted rss counters, and reclaim-time bad-page conditions. Exploitation requires local access with low privileges and no user interaction.

No verified exploit code examples are available. See the upstream commits linked in Kernel Git Commit 62153767 for the technical fix details.

Detection Methods for CVE-2026-64181

Indicators of Compromise

Kernel log entries containing WARNING: mm/memory.c:735 at __vm_normal_page
BUG: Bad rss-counter state messages in dmesg output
BUG: Bad page state warnings emitted during memory reclaim operations
Anomalous huge zero folio accounting reported in /proc/[pid]/smaps or pagemap

Detection Strategies

Monitor kernel ring buffer output via dmesg and journal collectors for the specific __vm_normal_page warning signature.
Aggregate kernel warning events across the fleet to detect systemic exposure on 32-bit hosts running THP.
Correlate Bad rss-counter state events with subsequent process termination or memory reclaim anomalies.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on mm/memory.c warning patterns.
Inventory hosts running 32-bit Linux kernels with THP enabled to prioritize remediation.
Track process stability metrics on affected hosts to identify workloads triggering the fault path.

How to Mitigate CVE-2026-64181

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available.
Identify all 32-bit Linux systems with Transparent Huge Pages enabled and schedule remediation.
Restrict local user access on affected systems until patches are deployed.

Patch Information

The fix teaches vm_normal_page_pmd() and vm_normal_page_pud() to consider whether pmd_special/pud_special is actually implemented on the target architecture. See the upstream commits: Kernel Git Commit 62153767, Kernel Git Commit 9052ea2e, and Kernel Git Commit c0c6ccd9.

Workarounds

Disable Transparent Huge Pages on affected 32-bit systems by setting transparent_hugepage=never on the kernel command line.
Switch workloads to 64-bit kernels where CONFIG_ARCH_SUPPORTS_PMD_PFNMAP is enabled.
Set /sys/kernel/mm/transparent_hugepage/enabled to never at runtime as a temporary control.

bash

# Disable THP at runtime as a mitigation
echo never > /sys/kernel/mm/transparent_hugepage/enabled
echo never > /sys/kernel/mm/transparent_hugepage/defrag

# Verify current setting
cat /sys/kernel/mm/transparent_hugepage/enabled