Linux Kernel EUVD-2026-39280

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or mainline 7.1 (or your distribution's equivalent backport). The fix is the one-line reordering that updates the file PMD counter before folio_put(); apply it by taking your distro's updated kernel package and rebooting, since live-patching of mm core paths is generally not offered. The authoritative fix commits are at https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce and the related commits listed in the references, with NVD tracking at https://nvd.nist.gov/vuln/detail/CVE-2026-53189. There is no clean feature-level workaround because PMD splitting is core to THP handling; the only meaningful compensating control short of patching is to reduce exposure to transparent huge pages by setting /sys/kernel/mm/transparent_hugepage/enabled to 'never' (and disabling shmem THP via /sys/kernel/mm/transparent_hugepage/shmem_enabled), which shrinks the vulnerable code path at the cost of degraded performance for memory-intensive and large-page workloads - and note this does not eliminate all file-PMD split paths, so it is mitigation, not a fix. Restricting untrusted local code execution and tightening container/seccomp boundaries further limits who can drive the race.