CVE-2026-31575

Description

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix hugetlb fault mutex hash calculation In mfill_atomic_hugetlb(), linear_page_index() is used to calculate the page index for hugetlb_fault_mutex_hash(). However, linear_page_index() returns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash() expects the index in huge page units. This mismatch means that different addresses within the same huge page can produce different hash values, leading to the use of different mutexes for the same huge page. This can cause races between faulting threads, which can corrupt the reservation map and trigger the BUG_ON in resv_map_release(). Fix this by introducing hugetlb_linear_page_index(), which returns the page index in huge page granularity, and using it in place of linear_page_index().

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (包含漏洞代码的版本，具体需参考Git补丁提交前的版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC Concept for CVE-2026-31575
 * This PoC demonstrates the logic to trigger the race condition.
 * It requires a system configured with hugepages and userfaultfd support.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <linux/userfaultfd.h>
#include <pthread.h>
#include <errno.h>

#define _UFFDIO_REGISTER (1 << 0)

void* fault_handler_thread(void* arg) {
    // Handler logic to manage page faults
    // Intentionally delay processing to widen the race window
    sleep(1);
    return NULL;
}

int main() {
    // 1. Create userfault file descriptor
    int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
    if (uffd == -1) {
        perror("userfaultfd");
        return 1;
    }

    // 2. Allocate memory with MAP_HUGETLB
    // Ensure system has hugepages configured (e.g., /proc/sys/vm/nr_hugepages)
    void* addr = mmap(NULL, 2 << 20, PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
    if (addr == MAP_FAILED) {
        perror("mmap hugetlb");
        // Fallback for testing if hugetlb not configured, though vulnerability is specific to hugetlb
        fprintf(stderr, "Hint: Configure hugepages first.\n");
        return 1;
    }

    // 3. Register the memory range with userfaultfd
    struct uffdio_register reg = {
        .range = { .start = (unsigned long)addr, .len = 2 << 20 },
        .mode = _UFFDIO_REGISTER
    };
    // ioctl(uffd, UFFDIO_REGISTER, &reg) ...

    printf("[+] Region mapped at %p\n", addr);

    // 4. Trigger the race
    // Spawn threads to write to different offsets within the same huge page
    // The bug causes linear_page_index to return different hashes for same huge page
    // leading to different mutexes and race condition.
    
    printf("[+] Attempting to trigger race condition...\n");
    
    // Implementation of threading and writing would go here
    // to exploit the mismatch in mutex hash calculation.

    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31575
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31575
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31575/
[4] VulDB https://vuldb.com/cve/CVE-2026-31575
[5] https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac
[6] https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290
[7] https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba
[8] https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172
[9] https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31575", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-24T15:16:32.123", "lastModified": "2026-04-27T23:15:42.890", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/userfaultfd: fix hugetlb fault mutex hash calculation\n\nIn mfill_atomic_hugetlb(), linear_page_index() is used to calculate the\npage index for hugetlb_fault_mutex_hash(). However, linear_page_index()\nreturns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()\nexpects the index in huge page units. This mismatch means that different\naddresses within the same huge page can produce different hash values,\nleading to the use of different mutexes for the same huge page. This can\ncause races between faulting threads, which can corrupt the reservation\nmap and trigger the BUG_ON in resv_map_release().\n\nFix this by introducing hugetlb_linear_page_index(), which returns the\npage index in huge page granularity, and using it in place of\nlinear_page_index()."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.84", "matchCriteriaId": "9BC7BB9E-B7C1-413D-9B8D-BE033C486508"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.24", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.14", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.0.1", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}