CVE-2026-31397: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31397 is a NULL pointer dereference and memory corruption vulnerability in the Linux kernel's move_pages_huge_pmd() function within the mm/huge_memory subsystem. The flaw affects the handling of UFFDIO_MOVE userfaultfd operations for huge zero pages, where a NULL folio pointer is incorrectly used, leading to invalid PMD entries or kernel crashes. Affected versions include Linux kernel 6.16 through 6.18.x (before 6.18.20), 6.19.x (before 6.19.10), and 7.0 release candidates (rc1–rc4). It was published on April 3, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In move_pages_huge_pmd(), when processing huge zero pages via UFFDIO_MOVE, src_folio is set to NULL as a sentinel value. The function then incorrectly passes this NULL through folio_mk_pmd(NULL, pgprot) → folio_pfn() → page_to_pfn(). On systems with SPARSEMEM_VMEMMAP, this silently produces a bogus PFN and installs a PMD entry pointing to non-existent physical memory; on other memory models, it causes a NULL dereference. A secondary issue exists where the function reconstructs the destination PMD from the folio rather than deriving it from src_pmdval, dropping pmd_special() state on architectures with CONFIG_ARCH_HAS_PTE_SPECIAL. This causes vm_normal_page_pmd() to treat the moved huge zero PMD as a normal page, corrupting its reference count. The fix uses page_folio(src_page) to obtain the valid huge zero folio and derives the destination PMD entry from src_pmdval after pmdp_huge_clear_flush() (GitHub Advisory).

A local attacker with permission to use the UFFDIO_MOVE userfaultfd operation can corrupt kernel memory structures — specifically PMD entries and folio reference counts — potentially crashing the system (denial of availability) or achieving arbitrary code execution with kernel privileges. The confidentiality, integrity, and availability impacts are all rated High, as successful exploitation could expose sensitive kernel memory, corrupt data structures, or allow privilege escalation to root. The vulnerability is confined to the local system scope but poses significant risk on multi-tenant or shared Linux environments (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), placing it in the 5th percentile for exploitation likelihood within 30 days. Exploitation requires local access and the ability to invoke UFFDIO_MOVE userfaultfd operations, which limits the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory).

Update the Linux kernel to a patched version: 6.18.20 or later (for 6.16–6.18.x branches), 6.19.10 or later (for 6.19.x), or any release after the 7.0-rc4 pre-release series. Patches are available via the stable kernel tree at the following commits: e3133d0986dc, f3caaee0f9e4, and fae654083bfa. As a workaround, restrict or disable access to userfaultfd operations (e.g., via sysctl vm.unprivileged_userfaultfd=0) if not required by your workload, as UFFDIO_MOVE is the entry point for this vulnerability. Amazon Linux 2023 users should apply ALAS2023-2026-1596 (GitHub Advisory).

The Yocto Project security mailing list discussed the vulnerability across multiple messages in late April 2026, indicating awareness in the embedded Linux community. Amazon Web Services issued a security advisory (ALAS2023-2026-1596) for Amazon Linux 2023, and Tenable published a Nessus detection plugin (ID 311340). No notable public researcher commentary or broader media coverage has been identified beyond standard vulnerability tracking and distribution-level advisories.