Skip to main content

Linux Kernel CVE-2026-31648

| EUVDEUVD-2026-25541 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-04-24 Linux GHSA-5fqc-9jpf-8wjm
Denial Of Service Linux Integer Overflow
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell access
  2. Delivery
    Launch multi-threaded mmap/truncate race
  3. Exploit
    Trigger integer overflow in filemap_map_pages
  4. Execution
    Corrupt adjacent kernel page structures
  5. Impact
    Exploit corrupted metadata for privilege escalation or denial of service

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local code execution with ability to invoke mmap() and ftruncate()/truncate() syscalls (standard unprivileged user capabilities on Linux). Exploitation depends on triggering the precise race timing where one CPU thread executes filemap_map_pages() concurrent with another thread performing ext4_setattr() or equivalent filesystem truncate operation that reduces inode->i_size. The vulnerability triggers most reliably on multi-core systems under memory pressure with large folio allocations enabled (default in modern kernels). The specific configuration tested by the reporter used ARM64 architecture running stress-ng memory testing tools, but the race is architecture-independent. No special kernel build flags, boot parameters, or non-default filesystem mount options are required. The flaw affects default configurations of all Linux distributions shipping vulnerable kernel versions. Success probability increases with higher core counts and faster storage subsystems that enable tight race windows.
Impact

Real-world exploitation risk is moderate despite the high CVSS 7.8 score. The local attack vector (AV:L) limits exposure to scenarios where untrusted code already executes on the system, reducing the initial access barrier compared to remotely exploitable flaws. However, the low attack complexity (AC:L) and no user interaction requirement (UI:N) mean that any local user can trigger the race condition through normal mmap/truncate syscall sequences without requiring special permissions beyond PR:L (low privileges). The EPSS score of 0.02% (5th percentile) indicates security researchers and attackers have not prioritized this vulnerability, likely because exploiting memory corruption races for reliable privilege escalation requires significant technical sophistication. No CISA KEV listing and no public POC further support low immediate risk. The technical impact severity is nonetheless real: kernel memory corruption can destabilize systems (high availability impact), potentially leak kernel memory contents (high confidentiality impact), or in skilled hands enable privilege escalation to root (high integrity impact). Organizations running multi-tenant systems, containers, or untrusted workloads should prioritize patching. Single-user workstations face lower practical risk. SSVC decision tree: exploitation=none, automatable=no (requires race timing), technical-impact=total (kernel memory corruption) suggests scheduled patching rather than emergency response.
Exploit ScenarioDerived

An unprivileged local attacker runs a multi-threaded application where one thread memory-maps a large file using mmap() while a second thread repeatedly truncates the same file using ftruncate(). By carefully timing these operations, the attacker triggers the race condition where filemap_map_pages() calculates end_pgoff based on the truncated file size but then maps pages from the folio retrieved before truncation. The resulting integer overflow causes the kernel to establish page table entries beyond the folio boundary, corrupting adjacent kernel page structures. The attacker monitors for 'Bad page state' kernel warnings indicating successful corruption, then leverages the corrupted page metadata to escalate privileges or cause targeted denial of service. The race timing requires some tuning but is achievable on standard multi-core systems with stress testing tools like stress-ng.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 27, 2026

Race condition in Linux kernel memory management allows local attackers with low privileges to corrupt kernel page state, potentially achieving high-impact denial of service, data corruption, or privilege escalation. The vulnerability affects kernel versions 6.6.x through 7.0-rc3, with patches confirmed released for stable branches 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS exploitation probability is low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified at time of analysis. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity, while the specific race condition requires precise timing between file mapping and inode size modification operations.

RemediationAI

Upgrade to patched kernel versions: 6.6.135 or later for the 6.6.x series, 6.12.82 or later for 6.12.x, 6.18.23 or later for 6.18.x, 6.19.13 or later for 6.19.x, or 7.0 final release for mainline users. Patches available at git.kernel.org stable tree commits 88591194df73 (6.6.x), f58df566524e (6.12.x), 633ab680c405 (6.18.x), 576543bedd61 (6.19.x), and 9316a820b9aa (7.0). Distribution-specific packages from Red Hat, Ubuntu, Debian, and SUSE will incorporate these fixes into their update channels with vendor-specific versioning. The upstream fix relocates end_pgoff calculation to occur before folio retrieval, eliminating the race window between size check and page mapping. No effective workarounds exist short of disabling file-backed mmap entirely (not practical). Compensating controls include restricting local user access, deploying kernel runtime integrity monitors (e.g., LKRG), and enabling kernel page table isolation (KPTI) which provides partial mitigation by isolating user/kernel address spaces, though KPTI does not prevent the race itself. Organizations unable to patch immediately should prioritize monitoring for unexpected kernel crashes with 'Bad page state' messages and consider restricting untrusted local code execution until patching is complete.

Affected VersionsENISA

Linux 84ede15f27c06b111d1398dfa80b6fac4b135e34
Linux 743a2753a02e805347969f6f89f38b736850d808 <f58df566524ebcdfa394329c64f47e3c9257516e
Linux 743a2753a02e805347969f6f89f38b736850d808 <633ab680c405ac390e6bec5b74aaf46197c837b6
Linux patch: 6.19.13
Linux patch: 0
Linux 6.12
Linux 743a2753a02e805347969f6f89f38b736850d808 <9316a820b9aae07d44469d6485376dad824c5b3f
Linux patch: 6.6.135
Linux fe601b70eac6cd266e8d7d55030e90a73ed0e339 <88591194df736a508dd5461ab2167a61e98caac1
Linux patch: 6.12.82
Linux patch: 6.18.23
Linux 743a2753a02e805347969f6f89f38b736850d808 <576543bedd616254032d4ebe54a90076f9e31740
Linux patch: 7.0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the Linux kernel's memory-mapped file page fault handler (filemap_map_pages()) in mm/filemap.c. When applications map files via mmap(), the kernel uses large folios (multi-page memory structures) for efficiency. The flaw is a time-of-check-time-of-use (TOCTOU) race between calculating the file end boundary and actually mapping pages. If another thread concurrently shrinks the file via truncate/setattr operations (reducing inode->i_size), the end_pgoff calculation can become stale. This causes nr_pages arithmetic overflow when computing 'min(end, end_pgoff) - xas.xa_index + 1', leading filemap_map_folio_range() to establish page table entries beyond the folio's actual size. The resulting out-of-bounds PTEs corrupt metadata fields (particularly _mapcount and _refcount) of adjacent kernel page structures not belonging to the folio. The ext4 filesystem triggers the observed case, but the vulnerability is filesystem-agnostic, affecting any file-backed mmap with concurrent truncation. CPE strings confirm impact across all Linux kernel architectures from commit 743a2753a02e through 7.0-rc3.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 27, 2026 - 20:13 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:45 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

" [ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount "

After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears:

" [ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566] filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583] do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188 "

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

By adding more debug information, I found that 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio (e.g., page->_mapcount).

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

....... //shrink the inode->i_size i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Executive ViewAI

Why It Matters

CVE-2026-31648 is a high-severity race condition in Linux kernel memory management affecting versions 6.6 through 7.0-rc3 that allows local attackers with low privileges to corrupt kernel page state, potentially resulting in denial of service, data corruption, or privilege escalation. Organizations running affected kernel versions on multi-user or containerized systems should prioritize patching to prevent insider threats or container escape scenarios that could compromise system stability and data integrity.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigations pending full patching: restrict local user access and privilege escalation vectors through mandatory access control (AppArmor/SELinux), disable unprivileged user namespace creation (kernel.unprivileged_userns_clone=0), and isolate multi-tenant workloads using stricter container isolation policies.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31648 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/359462 REF https://git.kernel.org/stable/c/576543bedd616254032d4ebe54a90076f9e31740 REF https://git.kernel.org/stable/c/633ab680c405ac390e6bec5b74aaf46197c837b6 REF https://git.kernel.org/stable/c/88591194df736a508dd5461ab2167a61e98caac1 REF https://git.kernel.org/stable/c/9316a820b9aae07d44469d6485376dad824c5b3f REF https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy