CVE-2026-23375: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23375 is a Linux kernel vulnerability in the transparent huge page (THP) implementation where file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g., guest_memfd and secretmem). This flaw can lead to kernel crashes or denial of service conditions on affected systems. It affects Linux kernel versions from 6.8.1 up to (but not including) 6.12.78, from 6.13 up to 6.18.17, from 6.19 up to 6.19.7, and certain 7.0 release candidates. The vulnerability was published on March 25, 2026, with patches identified the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper check in file_thp_enabled(), classified under CWE-825 (Expired Pointer Dereference) and CWE-617 (Reachable Assertion). Anonymous inode files created via alloc_file_pseudo() do not call get_write_access(), leaving inode->i_writecount at 0; combined with S_ISREG(inode->i_mode) being true, these files appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them incorrectly eligible for THP collapse. For guest_memfd, khugepaged and MADV_COLLAPSE can create large folios that the fault handler does not support, triggering WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). For secretmem, collapse_file() attempts to copy page contents through the direct map, but secretmem pages are removed from it, causing a kernel page fault crash (e.g., BUG: unable to handle page fault for address in memcpy_orig). The fix adds an IS_ANON_FILE(inode) check in file_thp_enabled() to exclude all anonymous inode files from THP eligibility (Red Hat Bugzilla).

Successful exploitation leads to a denial of service — either a kernel crash (page fault during memcpy in collapse_file() for secretmem) or kernel warnings and system instability (for guest_memfd). Confidentiality and integrity are not directly impacted; the primary risk is availability, with potential for complete system crash on affected hosts. Systems running KVM virtualization with guest_memfd or using secretmem are particularly at risk, and kernel crashes in these contexts could disrupt hosted virtual machines or sensitive memory operations (Red Hat Bugzilla, Red Hat Advisory).

• Logs: Kernel log entries containing BUG: unable to handle page fault for address with RIP: 0010:memcpy_orig in the call trace, or WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(), indicating THP collapse triggered on anonymous inodes.
• Logs: Kernel messages referencing Memory failure: <addr>: recovery action for clean unevictable LRU page: Recovered — false memory failure reports generated during secretmem collapse attempts.
• Process: Unusual activity from khugepaged daemon coinciding with guest_memfd or secretmem usage, particularly on KVM hypervisor hosts.

Apply the upstream kernel patches available as of March–April 2026 via the stable kernel tree (commits 0524ee56af2c, 08de46a75f91, dd085fe9a8eb, f6fa05f0dddd). Red Hat Enterprise Linux 10 users should apply RHSA-2026:21557, which addresses this issue. Debian has released fixes in linux 6.12.85+1 (stable-security) and backports. Amazon Linux 2023 users should apply ALAS2023-2026-1594. SUSE users should apply SUSE-SU-2026:21834-1. As a temporary workaround where patching is not immediately possible, consider disabling CONFIG_READ_ONLY_THP_FOR_FS at build time, though this may reduce THP performance benefits for legitimate filesystem files (Red Hat Bugzilla, Red Hat Advisory).

Red Hat tracked and addressed the issue via RHSA-2026:21557 for Red Hat Enterprise Linux 10, and the upstream fix was announced via the linux-cve-announce mailing list. The Yocto Project security list and openSUSE security announce list also distributed notifications. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.