CVE-2026-68086: Linux Kernel Privilege Escalation Flaw

CVE-2026-68086 Overview

CVE-2026-68086 is a data loss vulnerability in the Linux kernel's mm/khugepaged subsystem. The flaw affects how the kernel collapses file-backed transparent huge pages (THPs) when dirty folios remain in the page cache from previous writers. Under a specific race condition between collapse_file() and a subsequent writable file open, dirty page cache contents can be discarded by truncate_inode_pages() before being written back to disk.

The issue exists in stable kernel branches only. Upstream commit 044925f9b565 removed the affected code path when it eliminated the filemap_nr_thps*() functions and their users.

Critical Impact
Silent data loss can occur when madvise(MADV_COLLAPSE) is used against file mappings that contain dirty folios not yet written back to persistent storage.

Affected Products

Linux kernel stable branches containing the filemap_nr_thps accounting code
Filesystems supporting file-backed THPs through khugepaged
Workloads using madvise(MADV_COLLAPSE) on shared or previously-written file mappings

Discovery Timeline

2026-08-10 - CVE-2026-68086 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68086

Vulnerability Analysis

The khugepaged kernel thread collapses regular pages into transparent huge pages to improve TLB efficiency. For file-backed mappings, the kernel enforces mutual exclusion between writable file opens and the presence of THPs, because most filesystems are not THP-aware. When a process calls open() with O_RDWR or O_WRONLY on a file that has THPs, do_dentry_open() invokes truncate_inode_pages() to drop the cached huge pages.

This truncation is normally safe because writable opens are excluded while THPs exist, so no dirty data should be present. The exclusion is incomplete, however: collapse_file() can coexist with dirty folios left behind by prior writers even though it excludes concurrent writers.

Root Cause

The root cause is a missing writeback-and-wait step in collapse_file(). The code path assumes that any dirty folios produced by earlier writable opens have been flushed before collapse begins, but no invariant enforces this. When a later open(O_RDWR) observes nr_thps > 0 and triggers truncate_inode_pages(), both the collapsed THPs and any still-dirty folios are discarded together, resulting in loss of unflushed writes.

Attack Vector

The issue is triggered through a legitimate sequence of filesystem operations rather than a targeted exploit. A process writes to a file and closes it, another actor issues madvise(MADV_COLLAPSE) against a non-dirty range of that file's mapping, and a subsequent writable open() on the file causes the truncation. Any dirty folios that were not yet written back are lost. The fix performs a full page cache writeback under the invalidate_lock during collapse, guaranteeing no dirty folio coexists with active THPs. As a side effect, the nr_thps counter increment is moved outside the i_pages lock, relying on the atomic_t counter and an smp_mb() barrier in collapse_file() paired with the full ordering in get_write_access() and atomic_inc_unless_negative().

This vulnerability represents a kernel data integrity flaw rather than a memory corruption or code execution primitive. See the Kernel Git Commit Change for the patch details.

Detection Methods for CVE-2026-68086

Indicators of Compromise

Silent file data loss on systems using MADV_COLLAPSE against file-backed mappings where recent writes appear missing after subsequent writable opens.
Application-level checksum or integrity failures on files that were recently written and then re-opened with O_RDWR or O_WRONLY.
Elevated khugepaged activity coinciding with filesystems that report non-zero filemap_nr_thps counters.

Detection Strategies

Audit kernel versions across the fleet to identify hosts running stable branches that predate the backported fix referenced in the commit 2dfe9f5c91d0.
Instrument workloads that call madvise(MADV_COLLAPSE) and correlate their activity with subsequent writable file opens on the same inode.
Compare application-level write logs against on-disk contents after collapse-adjacent workflows to detect discrepancies.

Monitoring Recommendations

Track kernel build versions and patch levels through configuration management to confirm the fix is applied.
Monitor filesystem integrity for workloads that combine THP usage with frequent writable opens of the same files.
Alert on unexpected file content divergence detected by backup or replication systems.

How to Mitigate CVE-2026-68086

Immediate Actions Required

Apply the stable kernel update that includes commit 2dfe9f5c91d0963058f8a5e46e1c2a908382cc46 to affected hosts.
Reboot systems after installing the updated kernel package so the fix takes effect.
Inventory workloads that call madvise(MADV_COLLAPSE) on file mappings and prioritize those hosts for patching.

Patch Information

The fix is available in the Linux stable tree at Kernel Git Commit Change. The patch adds a full writeback-and-wait step under the invalidate_lock inside collapse_file(), ensuring that no dirty folio remains when THPs are active. There is no upstream mainline commit because the affected code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users").

Workarounds

Disable file-backed THP collapse by avoiding madvise(MADV_COLLAPSE) calls against file mappings until the patched kernel is deployed.
Restrict use of transparent huge pages on file-backed mappings by tuning /sys/kernel/mm/transparent_hugepage/ policies where feasible.
Ensure applications call fsync() after writes and before releasing file descriptors that may later be collapsed, to reduce the window where dirty folios can be discarded.

bash

# Verify kernel version and disable file-backed THP as a temporary mitigation
uname -r
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
cat /sys/kernel/mm/transparent_hugepage/enabled