Skip to main content

Linux Kernel EUVDEUVD-2026-24811

| CVE-2026-31466 MEDIUM
Race Condition (CWE-362)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-j7cp-5j3g-7q5w
Information Disclosure Linux Race Condition Huawei
4.7
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local system access
  2. Delivery
    Trigger transparent huge page allocation
  3. Exploit
    Initiate concurrent folio split and zap operations
  4. Install
    Achieve memory barrier race condition
  5. C2
    Expose unlocked folio state
  6. Execute
    Trigger VM_WARN_ON_ONCE panic
  7. Impact
    System denial of service

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) Local user access to the system (PR:L in CVSS vector), (2) arm64 system architecture where the race is observable (the vulnerability manifests on arm64 servers specifically due to memory ordering semantics), (3) transparent huge pages enabled in the kernel configuration and active via /sys/kernel/mm/transparent_hugepage/enabled, (4) concurrent execution of workloads that trigger both deferred_split_scan() folio splitting and zap_nonpresent_ptes() page zapping, (5) memory pressure conditions that force frequent mTHP splitting and reclamation. The race condition requires precise timing (AC:H) to manifest; casual single-threaded applications rarely trigger it. Systems with kernel-compiled warn_on_panic=1 or panic_on_oops=1 escalate impact from warning to immediate denial of service; default configurations issue a warning but continue execution. The vulnerability does not affect non-arm64 architectures due to different memory barrier semantics.
Impact

CVSS 4.7 with local attack vector (AV:L), high complexity (AC:H), and low privileges (PR:L) indicates the vulnerability requires local access and a specific race condition window, hence the conservative scoring. However, EPSS 0.02% (7th percentile) reveals this is near the bottom of real-world exploitation frequency, suggesting the race is difficult to trigger reliably in production. The kernel's VM_WARN_ON_ONCE() triggers a warning rather than a crash in most configurations, and the panic only occurs if the kernel is configured with warn_on_panic enabled. KEV status is not listed as actively exploited. The impact is denial of service on arm64 servers under specific memory pressure conditions triggering concurrent mTHP splitting and THP zapping. For most deployments, this represents a low real-world risk: the AC:H parameter reflects that race conditions require precise timing, and PR:L limits exploitation to local users. However, cloud/container environments running arm64 with aggressive memory management policies face elevated risk. The discrepancy between CVSS 4.7 and EPSS 0.02% is explained by the difficulty of reliably triggering the race in the wild despite reasonable impact severity.
Exploit ScenarioDerived

A local attacker on an arm64 system crafts a workload that simultaneously triggers mTHP (mega-transparent huge page) splitting via deferred_split_scan() and concurrent memory zapping via processes with madvise(MADV_DONTNEED) or mremap() operations. By inducing heavy memory pressure and controlling the timing of page table updates, the attacker achieves a race condition where softleaf_to_folio() observes stale memory due to CPU reordering, causing a folio to appear unlocked when accessed. This triggers the VM_WARN_ON_ONCE() panic in pfn_swap_entry_folio(), resulting in a denial of service if the system is configured to panic on warnings.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 07, 2026

A race condition in Linux kernel memory management causes folio objects to be accessed without proper locking during concurrent mega-transparent huge page (mTHP) splitting and zap operations on arm64, triggering a denial-of-service condition via VM_WARN_ON_ONCE() panic when the missing memory barrier allows CPU reordering to expose unlocked folio state. The vulnerability affects Linux kernel versions before 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.21, 6.19.11, and 7.0 with EPSS score of 0.02% indicating low real-world exploitation likelihood despite moderate CVSS impact rating.

RemediationAI

Apply vendor-released patches immediately: upgrade to Linux kernel 5.10.253 or later (5.10 series), 5.15.203 or later (5.15 series), 6.1.168 or later (6.1 series), 6.6.134 or later (6.6 series), 6.12.81 or later (6.12 series), 6.18.21 or later (6.18 series), 6.19.11 or later (6.19 series), or 7.0 final release. The fix involves adding smp_rmb() barriers in softleaf_to_folio() and softleaf_to_page() functions when handling migration entries. For systems unable to patch immediately, consider disabling memory compaction or reducing transparent huge page usage via /sys/kernel/mm/transparent_hugepage/enabled, though this trades security for performance degradation. Alternatively, restrict concurrent workloads that trigger aggressive page splitting and zapping on arm64 systems by using CPU pinning and memory policies to serialize access patterns, reducing the likelihood of hitting the race window. Reboot is required after patching to activate the fix. Commits are available at https://git.kernel.org/stable/ with the specific commit hashes provided in references.

Affected VersionsENISA

Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <7ad1997b9bc8032603df8f091761114479285769
Linux patch: 6.18.21
Linux patch: 5.15.203
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd
Linux patch: 6.6.134
Linux patch: 6.12.81
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <b8c49ad888892ad7b77062b9c102b799a3e9b4f8
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7
Linux patch: 6.1.168
Linux patch: 5.10.253
Linux patch: 0
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <4c5e7f0fcd592801c9cc18f29f80fbee84eb8669
Linux 4.5
Linux patch: 6.19.11
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <722cfaf6b31d31123439e67b5deac6b1261a3dea
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <426ee10711586617da869c8bb798214965337617
Linux e9b61f19858a5d6c42ce2298cf138279375d0d9b <7ddcf4a245c1c5a91fdd9698757e3d95179ffe41
Linux patch: 7.0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the mm/huge_memory subsystem, specifically in the softleaf_to_folio() function which retrieves folio objects from migration entries during page table operations. The root cause is a missing smp_rmb() (read memory barrier) that should pair with smp_wmb() in __split_folio_to_order(). When deferred_split_scan() splits a folio and changes PTEs to migration entries via unmap_folio(), it uses smp_wmb() to ensure page flags (including PG_locked) are visible before the folio becomes non-compound. Without the corresponding smp_rmb() in softleaf_to_folio(), concurrent zap_nonpresent_ptes() operations can observe CPU-reordered memory, causing the function to see an updated compound_head before the lock flag is visible, violating the invariant that a folio must be locked before modification. This is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), a classic race condition in memory barrier usage.

Know when Huawei gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
CVSS changed
May 07, 2026 - 18:37 NVD
4.7 (MEDIUM)
Patch released
Apr 23, 2026 - 16:17 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
CVE Published
Apr 22, 2026 - 14:16 nvd
N/A
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 4.7

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix folio isn't locked in softleaf_to_folio()

On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows:

CPU0 CPU1

deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages

In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags.

This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held.

This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1.

To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page().

[tujinjiang@huawei.com: update function name and comments]

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Threat Intel
2
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

More in Huawei

View all
CVE-2014-9222 CRITICAL POC
10.0 Dec 24

AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows re
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2013-4630 HIGH POC
7.6 Jun 20

Stack-based buffer overflow on Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 debugging is enabled, allow
CVE-2020-8840 CRITICAL
9.8 Feb 10

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apac
CVE-2019-2215 HIGH POC
7.8 Oct 11

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severi
CVE-2017-3216 CRITICAL POC
9.8 Jun 20

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa
CVE-2016-2231 CRITICAL POC
9.8 Feb 15

The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the c
CVE-2012-4960 MEDIUM POC
6.5 Jun 20

The Huawei NE5000E, MA5200G, NE40E, NE80E, ATN, NE40, NE80, NE20E-X6, NE20, ME60, CX600, CX200, CX300, ACU, WLAN AC 6605
CVE-2015-7254 MEDIUM POC
5.0 Nov 07

Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary
CVE-2020-0022 HIGH POC
8.8 Feb 13

In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds cal
CVE-2020-37220 HIGH POC
8.7 May 13

Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain a
CVE-2013-4631 HIGH POC
7.8 Jun 20

Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of se

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31466 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/358862 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617 REF https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 REF https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea REF https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769 REF https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41 REF https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7 REF https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8 REF https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy