CVE-2026-53207
mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
Description
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock when racing with a concurrent unmap: thread#0 thread#1 -------- -------- madvise(folio, MADV_HWPOISON) -> poisons the folio successfully madvise(folio, MADV_HWPOISON) unmap(folio) try_memory_failure_hugetlb get_huge_page_for_hwpoison spin_lock_irq(&hugetlb_lock) <- held __get_huge_page_for_hwpoison hugetlb_update_hwpoison() -> MF_HUGETLB_FOLIO_PRE_POISONED goto out: folio_put() refcount: 1 -> 0 free_huge_folio() spin_lock_irqsave(&hugetlb_lock) -> AA DEADLOCK! The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop the GUP reference while the hugetlb_lock is still held by the hugetlb.c wrapper get_huge_page_for_hwpoison(). If concurrent unmap has released the page table mapping reference, folio_put() drops the folio refcount to zero, triggering free_huge_folio() which attempts to re-acquire the non-recursive hugetlb_lock. Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the folio_put() at the out: label so the folio is always released outside the lock. [[email protected]: fix race, rename label per Miaohe]
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 2, 2026, 8:55 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Move hugetlb_lock acquisition into get_huge_page_for_hwpoison.
- Release hugetlb_lock before calling folio_put.
- Ensure folio is released outside the lock.
- Apply provided kernel patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53207.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53207 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53207
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53207 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53207 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.54 up to (excluding) 5.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.18.1 up to (excluding) 6.1.176 Added Reference Type kernel.org: https://git.kernel.org/stable/c/3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/77b73b54801ae7137479c141fd0473a491c1dc48 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a33bfed648c10f5a1519981dbfad80841191edc8 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bf7ba8f96c258c30393814491930ae4ecdc5fe5e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dd77a83915b07e2b0205adb284f08b39ae31dc4b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fc3ff42cb0cbf947e4600ae9761c3783760050e2 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': 'fc3ff42cb0cbf947e4600ae9761c3783760050e2', 'versionType': 'git'}, {'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': '77b73b54801ae7137479c141fd0473a491c1dc48', 'versionType': 'git'}, {'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': 'a33bfed648c10f5a1519981dbfad80841191edc8', 'versionType': 'git'}, {'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': 'dd77a83915b07e2b0205adb284f08b39ae31dc4b', 'versionType': 'git'}, {'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': 'bf7ba8f96c258c30393814491930ae4ecdc5fe5e', 'versionType': 'git'}, {'status': 'affected', 'version': '405ce051236cc65b30bbfe490b28ce60ae6aed85', 'lessThan': '3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e', 'versionType': 'git'}, {'status': 'affected', 'version': '62d1655b922958826b7ec22682c3141746f75064', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.54', 'lessThan': '5.16', 'versionType': 'semver'}], 'programFiles': ['include/linux/hugetlb.h', 'include/linux/mm.h', 'mm/hugetlb.c', 'mm/memory-failure.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/linux/hugetlb.h', 'include/linux/mm.h', 'mm/hugetlb.c', 'mm/memory-failure.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock when racing with a concurrent unmap: thread#0 thread#1 -------- -------- madvise(folio, MADV_HWPOISON) -> poisons the folio successfully madvise(folio, MADV_HWPOISON) unmap(folio) try_memory_failure_hugetlb get_huge_page_for_hwpoison spin_lock_irq(&hugetlb_lock) <- held __get_huge_page_for_hwpoison hugetlb_update_hwpoison() -> MF_HUGETLB_FOLIO_PRE_POISONED goto out: folio_put() refcount: 1 -> 0 free_huge_folio() spin_lock_irqsave(&hugetlb_lock) -> AA DEADLOCK! The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop the GUP reference while the hugetlb_lock is still held by the hugetlb.c wrapper get_huge_page_for_hwpoison(). If concurrent unmap has released the page table mapping reference, folio_put() drops the folio refcount to zero, triggering free_huge_folio() which attempts to re-acquire the non-recursive hugetlb_lock. Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the folio_put() at the out: label so the folio is always released outside the lock. [[email protected]: fix race, rename label per Miaohe] Added Reference https://git.kernel.org/stable/c/3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e Added Reference https://git.kernel.org/stable/c/77b73b54801ae7137479c141fd0473a491c1dc48 Added Reference https://git.kernel.org/stable/c/a33bfed648c10f5a1519981dbfad80841191edc8 Added Reference https://git.kernel.org/stable/c/bf7ba8f96c258c30393814491930ae4ecdc5fe5e Added Reference https://git.kernel.org/stable/c/dd77a83915b07e2b0205adb284f08b39ae31dc4b Added Reference https://git.kernel.org/stable/c/fc3ff42cb0cbf947e4600ae9761c3783760050e2