Linux Kernel CVE-2026-31575

The vulnerability is in mm/userfaultfd.c within the Linux kernel memory management subsystem, specifically the mfill_atomic_hugetlb() function used for userfaultfd copy/zeropage operations on hugetlb-backed mappings. The bug is a unit mismatch: linear_page_index() computes a page frame number in PAGE_SIZE (typically 4 KB) units, but hugetlb_fault_mutex_hash() indexes its mutex array in huge page units (2 MB on x86-64, larger on other architectures). Two threads faulting at addresses within the same 2 MB huge page but at different 4 KB offsets will compute different hash values, acquire different mutexes, and concurrently mutate the hugetlb reservation map - a structure that assumes single-mutex serialization. This leads to map corruption and a BUG_ON panic in resv_map_release(). The fix introduces hugetlb_linear_page_index() which right-shifts by the huge page order before hashing. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected versions. No CWE was assigned, but the root cause class is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The 'Information Disclosure' tag from ENISA/EUVD is inconsistent with both the CVSS vector (C:N) and the description - the actual impact is availability (kernel panic), not confidentiality.