CVE-2026-80893: Linux Kernel Privilege Escalation Flaw

CVE-2026-80893 Overview

CVE-2026-80893 is a Linux kernel memory management flaw in the hugetlb subsystem. The copy_hugetlb_page_range() function incorrectly clears the userfaultfd write-protect (uffd-wp) bit on non-present page table entries during fork(). The clear operation targets the present-PTE bit position, but migration and hwpoison swap entries store state in a different location, causing the swap payload to be modified. On x86-64, the corrupted bit falls in the inverted swap offset, advancing the encoded page frame number (PFN) by two pages. The bug does not require userfaultfd to be active and triggers on a plain fork() when a hugetlb migration or poisoned page is in flight.

Critical Impact
A routine fork() in a process holding hugetlb migration or hwpoison entries can corrupt swap entries copied into the child, propagating incorrect PFN state through paths such as hugetlb_change_protection().

Affected Products

Linux kernel (mm/hugetlb subsystem)
Distributions shipping affected stable kernel branches referenced in the upstream fix commits
Systems using hugetlb pages with page migration or MADV_HWPOISON

Discovery Timeline

2026-09-04 - CVE-2026-80893 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80893

Vulnerability Analysis

The defect resides in copy_hugetlb_page_range(), which duplicates hugetlb page table entries when a process forks. For present entries, the function calls huge_pte_clear_uffd_wp() to strip the uffd-wp bit if the child virtual memory area (VMA) is not uffd-wp registered. That helper operates on the bit position used by present PTEs.

Migration and hwpoison entries are non-present swap entries. They encode state using pte_swp_uffd_wp() and pte_swp_mkuffd_wp() at a different bit location. The present-PTE bit position overlaps the swap payload. On x86-64, that position falls inside the inverted swap offset, and a naturally aligned hugetlb PFN always sets the affected bit.

Clearing the bit shifts the encoded PFN by two pages. Instrumentation after MADV_HWPOISON on a 2MB anonymous hugetlb page confirms the shift: the offset moves from 120e00 to 120e02. This is a kernel memory management flaw with silent data corruption characteristics.

Root Cause

The root cause is a mismatch between the bit-clearing helper and the entry format. huge_pte_clear_uffd_wp() assumes a present PTE layout, but the caller applies it unconditionally to migration and hwpoison swap entries. Migration entries legitimately carry uffd-wp and require pte_swp_clear_uffd_wp() for correct clearing. Hwpoison entries never carry uffd-wp because make_hwpoison_entry() installs them fresh and try_to_unmap_one() does not preserve the bit, so no clear is needed.

Attack Vector

Exploitation requires local execution with the ability to trigger hugetlb page migration or to invoke MADV_HWPOISON on a hugetlb mapping, followed by fork(). The corruption is mostly latent because remove_migration_pte() rebuilds the PTE from the folio on completion, healing within-folio PFN skew. However, any path that re-encodes the corrupted offset, such as hugetlb_change_protection() rewriting a writable migration entry via make_readable_migration_entry(swp_offset(entry)), propagates the incorrect PFN and can produce lasting memory management inconsistency.

The vulnerability manifests in kernel page-table copy logic. See the upstream commits under external references for the exact fix diff.

Detection Methods for CVE-2026-80893

Indicators of Compromise

Kernel log entries showing unexpected memory errors, bad page state warnings, or BUG: Bad page map messages tied to hugetlb-backed processes
Application crashes or SIGBUS in processes using hugetlbfs shortly after fork() operations
Anomalous page migration or memory failure events on nodes running workloads with hugetlb and MADV_HWPOISON usage

Detection Strategies

Audit running kernel versions against the fixed stable commits 2b9a0700, 2fa11c60, 69cb5825, 83abe2fd, 8b0de700, and f1b1311c
Monitor /proc/vmstat counters for pgmigrate_fail, thp_migration_fail, and hugetlb allocation anomalies
Correlate hugetlbfs usage with fork()-heavy workloads such as database engines, virtualization platforms, and HPC schedulers

Monitoring Recommendations

Ingest kernel ring buffer (dmesg) events into a centralized logging pipeline and alert on hugetlb, migration, and memory-failure signatures
Track process crash telemetry (SIGBUS, SIGSEGV) for services that pin hugetlb memory
Baseline kernel versions across the fleet and flag hosts on pre-patch releases

How to Mitigate CVE-2026-80893

Immediate Actions Required

Inventory Linux hosts running hugetlb workloads and identify kernels missing the upstream fix
Apply distribution kernel updates that include the referenced stable backports
Reboot patched systems to load the corrected kernel image

Patch Information

The fix replaces huge_pte_clear_uffd_wp() with pte_swp_clear_uffd_wp() for migration entries, matching copy_nonpresent_pte() and move_huge_pte(). For hwpoison entries, the clear is removed entirely because those entries never carry the uffd-wp bit. Patched kernels are available in the upstream stable tree via commits 2b9a0700, 2fa11c60, 69cb5825, 83abe2fd, 8b0de700, and f1b1311c.

Workarounds

Disable hugetlb pages for workloads that do not require them by removing hugepages= boot parameters and unmounting hugetlbfs
Avoid MADV_HWPOISON testing tooling on production hosts running affected kernels
Restrict local access on multi-tenant systems until patched kernels are deployed

bash

# Verify running kernel and compare against distribution advisories
uname -r

# Check hugetlb usage on the host
grep -i huge /proc/meminfo
mount | grep hugetlbfs

# Apply vendor kernel update (Debian/Ubuntu example)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot