CVE-2026-31398: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31398 is a reachable assertion vulnerability in the Linux kernel's memory management subsystem (mm/rmap) involving incorrect PTE (Page Table Entry) restoration for lazyfree folios. The flaw exists in folio_unmap_pte_batch(), where batches of anonymous lazyfree folios containing a mix of writable and non-writable PTEs may result in the entire batch being incorrectly marked writable, violating copy-on-write (CoW) semantics. Affected versions include Linux kernel 6.15 through 6.18.20 (exclusive), 6.19 through 6.19.10 (exclusive), and 7.0-rc1 through 7.0-rc4. Published on April 3, 2026, it carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-617 (Reachable Assertion): the kernel's page_table_check.c contains a BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw) assertion that fires when a writable anonymous page is mapped into more than one process's page table simultaneously — a condition that should never occur under correct CoW semantics (GitHub Advisory). The bug is triggered in folio_unmap_pte_batch() during memory reclaim of lazyfree folios: if a batch spans PTEs with mixed writable/non-writable bits (e.g., after a VMA split via MADV_DONTFORK followed by a merge via MADV_DOFORK), the function fails to respect individual PTE writable bits, causing the entire batch to be restored as writable. Exploitation requires local access and the ability to manipulate VMA layout, fork processes, issue MADV_FREE, and trigger memory reclaim — all standard unprivileged operations on Linux systems supporting multi-size THP (mTHP). The fix corrects folio_unmap_pte_batch() to respect both writable and soft-dirty bits during batching (GitHub Advisory).

Successful exploitation causes a kernel panic (BUG_ON assertion failure in mm/page_table_check.c), resulting in a denial of service by crashing the affected system. Beyond availability, the underlying memory corruption violates anonymous memory and CoW isolation guarantees, meaning a writable page could theoretically be simultaneously mapped into multiple processes' page tables, posing a risk to memory confidentiality and integrity between processes. The CVSS score reflects High impact across confidentiality, integrity, and availability (GitHub Advisory).

1. Setup mTHP: Configure the system to use 64K multi-size Transparent Huge Pages (mTHP) by setting the appropriate sysfs knob (e.g., echo always > /sys/kernel/mm/transparent_hugepage/hugepages-65536kB/enabled).
2. Fault in a large folio: Allocate and access a memory region to fault in a 64K large folio backed by anonymous memory.
3. Split the VMA: Use madvise(addr, 32K, MADV_DONTFORK) at the midpoint of the folio's range to split the VMA, causing the parent to have 8 writable PTEs and 8 non-writable PTEs pointing to the same folio after a fork.
4. Fork the process: Call fork() so the parent process holds the folio with mixed writable/non-writable PTEs across the split VMA.
5. Merge the VMAs: Call madvise(addr, 64K, MADV_DOFORK) to merge the VMAs back, allowing folio_unmap_pte_batch() to treat all 16 PTEs as a single batch.
6. Mark memory lazyfree: Call madvise(addr, 64K, MADV_FREE) to mark the folio as lazyfree.
7. Dirty the PTE: Write to the memory range so the PTE is dirtied and rmap marks the folio dirty.
8. Trigger reclaim: Trigger memory reclaim (e.g., via echo <value> > /sys/fs/cgroup/memory.reclaim or similar) to invoke shrink_folio_list() → try_to_unmap() → folio_unmap_pte_batch(), which incorrectly restores all PTEs as writable, triggering the BUG_ON in page_table_check_set() and crashing the kernel (GitHub Advisory).

• Logs: Kernel panic messages in dmesg or /var/log/kern.log containing kernel BUG at mm/page_table_check.c:118! and Oops - BUG: 00000000f2000800.
• Logs: Call trace entries referencing page_table_check_set, __page_table_check_ptes_set, try_to_unmap_one, rmap_walk_anon, shrink_folio_list, and shrink_lruvec in the kernel log.
• Process: Unexpected process crashes or system reboots on systems running kernel versions 6.15–6.18.20 or 6.19–6.19.10, particularly on workloads using large folios or mTHP.
• File System: Core dump files or crash dump artifacts (e.g., /var/crash/) generated around the time of the kernel panic (GitHub Advisory).

Apply the upstream kernel patches that fix folio_unmap_pte_batch() to correctly respect writable and soft-dirty bits during PTE batching. Patched commits are available at the stable kernel tree for affected branches (git.kernel.org patch 1, git.kernel.org patch 2, git.kernel.org patch 3). Upgrade to kernel versions 6.18.20 or later (for the 6.18.x branch), 6.19.10 or later (for the 6.19.x branch), or a stable 7.0 release once available. As a short-term workaround, disabling multi-size THP (mTHP) for 64K pages (echo never > /sys/kernel/mm/transparent_hugepage/hugepages-65536kB/enabled) may reduce exposure on systems where this feature is not required. Amazon Linux 2023 users should apply ALAS2023-2026-1596 (Amazon Advisory).

The vulnerability was announced via the official Linux kernel CVE mailing list (lore.kernel.org/linux-cve-announce) on April 3, 2026, and subsequently tracked by the Yocto Project security team across multiple advisories (Yocto Security). Amazon Web Services issued a security advisory (ALAS2023-2026-1596) for Amazon Linux 2023 users (Amazon Advisory). Tenable published a Nessus detection plugin (ID 311340) for the vulnerability. No significant social media controversy or notable independent researcher commentary has been observed beyond standard vulnerability tracking.