CVE-2026-63950: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-30
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous folio_unmap_pte_batch() call can be reused on a later iteration that does not run folio_unmap_pte_batch() again. mmap a 64K large folio with MAP_ANONYMOUS | MAP_DROPPABLE, then call madvise(MADV_FREE), then make the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE. Trigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will first clear the first 15 out of 16 entries mapping the lazyfree folio. This will set nr_pages to 15. In the next pvmw walk, this nr_pages gets reused on a device-exclusive pte, thus potentially corrupting folio refcount/mapcount. At the moment, I have a userspace program which can make the kernel spit out a trace, but the blow up is in folio_referenced_one(), because there are existing bugs in the interaction between device-private and rmap (which too I am investigating). I did a one liner kernel change to avoid going into folio_referenced_one(), and the kernel blows up at folio_remove_rmap_ptes in try_to_unmap_one which is what I wanted. Note that the bug is there not since file folio batching but lazyfree folio batching, since device-exclusive only works for anonymous folios. Userspace visible effect is simply kernel crashing somewhere due to refcount/mapcount corruption.

Affected products

Linux kernel: from 6.15 before 6.18.35; from 6.19 before 7.0.12; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5 — fixed in 6.18.35, 7.0.12
Linux kernel: 6.15 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.18.35, 7.0.12; Linux kernel 7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-63950 or the next vulnerability affects your stack