SB2026040639 - Always-Incorrect Control Flow Implementation in Linux kernel mm

Description

This security bulletin contains information about 1 security vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-31398)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect pte restoration in folio_unmap_pte_batch() when restoring page table entries for lazyfree folios during reclaim. A local user can trigger a crafted memory-management sequence to cause a denial of service.

The issue can lead to a kernel BUG and crash when a batch contains a mix of writable and non-writable bits, causing writable mappings to be restored incorrectly and breaking anonymous memory copy-on-write semantics.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/29f40594a28114b9a9bc87f6cf7bbee9609628f2
• https://git.kernel.org/stable/c/99888a4f340ca8e839a0524556bd4db76d63f4e0
• https://git.kernel.org/stable/c/a0911ccdba41b0871abbf8412857bafedec3dbe1