CVE-2026-64514: Linux Kernel Privilege Escalation Flaw

CVE-2026-64514 Overview

CVE-2026-64514 is a Linux kernel vulnerability in the userfaultfd subsystem. The functions userfaultfd_must_wait() and userfaultfd_huge_must_wait() read a page table entry (PTE) without acquiring the page table lock, then apply pte_write() or huge_pte_write() to the result. These accessors only decode bits from the present-PTE encoding. When the entry is a swap or migration entry, the accessors read offset bits that share the same position and return an undefined result. A faulting thread can be left indefinitely waiting for a UFFDIO_WAKE that never arrives.

Critical Impact
A userspace thread using userfaultfd can hang indefinitely when a fault races with page swap-in or migration, causing a denial-of-service condition in affected processes.

Affected Products

Linux kernel versions containing the affected userfaultfd write-protection wait logic
Distributions shipping vulnerable stable kernel branches (fixes backported across multiple git.kernel.org/stable branches)
Workloads relying on userfaultfd write-protection, including live migration, checkpoint/restore, and user-space memory managers

Discovery Timeline

2026-07-25 - CVE-2026-64514 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64514

Vulnerability Analysis

The userfaultfd feature allows userspace to handle page faults for specific memory regions. When a write-protected fault occurs, the kernel calls userfaultfd_must_wait() (or its hugepage counterpart) to determine whether the fault is still write-protected and the thread should sleep pending user handling. The check is deliberately lockless to avoid page table lock contention on the fault path.

The issue lies in interpreting the PTE bits without confirming the entry is present. pte_write() and huge_pte_write() are defined only for present PTEs. When the kernel evaluates them against a non-present entry, they inspect bit positions repurposed for swap or migration offsets, producing an undefined result. This is classified as a kernel race condition affecting PTE state interpretation.

Root Cause

The root cause is a missing pte_present() gate around the writability check. The lockless read may observe a swap entry or migration entry rather than a present PTE. The intent of the code is to answer the question "is this fault still write-protection blocked?", but the accessors cannot answer that question for non-present entries and silently return garbage.

Attack Vector

A local process using userfaultfd on memory that is subject to swap-out or migration can trigger the race. Under adverse timing, the garbage "write" bit reads as "wait", and the faulting thread stays asleep until a UFFDIO_WAKE that may never be delivered. The original userfault context has already been invalidated by the swap-in or migration completion path, which will re-deliver a fresh fault if userspace still needs to handle it. The affected thread is effectively hung, producing a denial-of-service condition against the workload.

No verified exploit code is publicly available for this issue. See the upstream commits listed under Patch Information for the corrected logic.

Detection Methods for CVE-2026-64514

Indicators of Compromise

Processes using userfaultfd showing threads stuck in uninterruptible or interruptible sleep on the userfault wait queue with no matching UFFDIO_WAKE activity
Live-migration, CRIU (Checkpoint/Restore in Userspace), or user-space memory-management workloads exhibiting stalls that coincide with memory pressure or page migration events
Kernel stack traces of hung tasks pointing to userfaultfd_must_wait or userfaultfd_huge_must_wait

Detection Strategies

Query the running kernel version against the fixed commits published on git.kernel.org/stable and flag hosts that predate the backport for the branch in use.
Correlate hung-task warnings emitted by khungtaskd with processes that have open /dev/userfaultfd or userfaultfd file descriptors visible in /proc/<pid>/fdinfo.
Track kernel taint and dmesg entries for repeated fault-wait stalls on workloads known to use userfaultfd write-protection.

Monitoring Recommendations

Enable CONFIG_DETECT_HUNG_TASK and forward khungtaskd output to centralized logging for review.
Instrument userfaultfd-consuming applications to emit metrics on fault wait duration and unmatched UFFDIO_WAKE counts.
Alert on unexpected process hangs on hosts running virtualization, container, or migration tooling that depends on userfaultfd.

How to Mitigate CVE-2026-64514

Immediate Actions Required

Inventory Linux hosts and identify kernels that do not yet include one of the upstream fix commits for CVE-2026-64514.
Apply the distribution kernel update that incorporates the backport for your stable branch as soon as it is available.
Prioritize patching on hosts running live migration, CRIU, sandboxing, or database engines that use userfaultfd write-protection.

Patch Information

The fix gates the writability check on pte_present() so that the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case now returns "don't wait" and lets the fault path retry. The change has been merged across multiple stable branches. Reference commits: 29e6f95, 5f4dbdb, 60d696a, 7101838, 8e80af5, a5700a4, a6e9a49, d402641.

Workarounds

Where feasible, restrict access to userfaultfd via vm.unprivileged_userfaultfd=0 so only privileged processes can create userfaultfd file descriptors.
Disable or avoid workloads that depend on userfaultfd write-protection on unpatched kernels until the update is deployed.
Configure hung-task detection and process supervisors to restart stuck processes as a temporary reliability control, recognizing this does not remove the underlying race.

bash

# Restrict userfaultfd to privileged processes as a temporary hardening step
sysctl -w vm.unprivileged_userfaultfd=0
echo 'vm.unprivileged_userfaultfd=0' >> /etc/sysctl.d/99-userfaultfd.conf

# Verify running kernel version against distribution advisories
uname -r