CVE-2026-31466: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31466 is a race condition vulnerability in the Linux kernel's memory management subsystem (mm/huge_memory), specifically in the softleaf_to_folio() function. The flaw causes a folio retrieved from a migration entry to be accessed without holding the folio lock, due to a missing smp_rmb() memory barrier. It was published on April 22, 2026, and affects Linux kernel versions from 4.5 through multiple stable branches, including 6.x series up to 7.0-rc5. It carries a CVSS v3.1 base score of 4.7 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a missing smp_rmb() read memory barrier in softleaf_to_folio() (CWE-362, CWE-366), which should pair with the smp_wmb() write barrier in __split_folio_to_order(). When CPU0 executes deferred_split_scan() and splits a folio — setting PG_locked flags for tail pages via smp_wmb() — a concurrent CPU1 executing zap_nonpresent_ptes() may call softleaf_to_folio() and observe the updated compound_head of a tail page before its page->flags are visible, due to the absent read barrier. This triggers VM_WARN_ON_ONCE(!folio_test_locked(folio)) in pfn_swap_entry_folio(), and was a hard BUG_ON() prior to commit 93976a20345b merged in v6.19-rc1. The fix adds smp_rmb() in both softleaf_to_folio() and softleaf_to_page() when the entry is a migration entry (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service through kernel instability or crash, with no confidentiality or integrity impact. A local user with low privileges on an ARM64 system can trigger the race condition through concurrent memory operations involving mTHP (multi-size Transparent Hugepage) splitting, causing the kernel to detect an unlocked folio modification and potentially panic or produce system instability. There is no evidence of data exfiltration risk or lateral movement potential associated with this vulnerability (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and high attack complexity (a precise race condition timing window), making opportunistic exploitation unlikely. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

• Logs: Kernel log entries containing VM_WARN_ON_ONCE(!folio_test_locked(folio)) or warnings from pfn_swap_entry_folio() in /var/log/kern.log or dmesg output.
• Logs: Kernel oops or BUG traces referencing softleaf_to_folio(), zap_nonpresent_ptes(), or deferred_split_scan() in kernel logs.
• Process: Unexpected system instability or crashes on ARM64 servers during workloads involving heavy memory pressure, transparent hugepage splitting, or page migration.

Patches are available in the following Linux kernel stable branches: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.21, and 6.19.11. Updating to one of these patched versions is the recommended remediation. For systems unable to patch immediately, minimizing concurrent memory operations and folio splitting workloads may reduce exposure; monitoring kernel logs for VM_WARN_ON_ONCE() warnings related to folio_test_locked() failures can serve as an early indicator of the issue (Github Advisory, Red Hat Bugzilla).