CVE-2026-31575: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31575 is a race condition vulnerability in the Linux kernel's userfaultfd hugetlb handling code, specifically in the mfill_atomic_hugetlb() function. The flaw stems from an incorrect mutex hash calculation where linear_page_index() returns a page index in PAGE_SIZE units, but hugetlb_fault_mutex_hash() expects the index in huge page units, causing different mutexes to be used for the same huge page. Affected Linux kernel versions include all releases up to (excluding) 6.12.84, 6.13–6.17.x up to (excluding) 6.18.24, 6.18.x up to (excluding) 6.18.24, 6.19.x up to (excluding) 6.19.14, and 7.0.x up to (excluding) 7.0.1. The vulnerability was published on April 24, 2026, with patches added by April 27, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-821 (Incorrect Synchronization). In mfill_atomic_hugetlb(), the use of linear_page_index() — which returns a page index in PAGE_SIZE granularity — to feed hugetlb_fault_mutex_hash() (which expects huge page granularity) causes a unit mismatch. As a result, different virtual addresses mapping to the same huge page can hash to different mutex buckets, meaning concurrent faulting threads may operate on the same huge page without mutual exclusion. This race condition can corrupt the kernel's hugetlb reservation map (resv_map) and trigger a BUG_ON assertion in resv_map_release(), crashing the kernel. The fix introduces a new helper hugetlb_linear_page_index() that returns the index in huge page units (Github Advisory, Feedly).

Successful exploitation of this vulnerability allows a local attacker with low privileges to trigger a kernel panic via the BUG_ON assertion in resv_map_release(), resulting in a denial of service (system crash). The race condition can also corrupt kernel memory structures managing hugetlb reservations, potentially leading to broader memory integrity issues within the kernel. There is no confidentiality or integrity impact beyond availability loss, and the scope is limited to the affected system (Feedly, Github Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the attack surface to authenticated users on affected systems.

Update the Linux kernel to a patched version: 6.12.84 or later (for kernels before 6.13), 6.18.24 or later (for 6.13–6.18.x), 6.19.14 or later (for 6.19.x), or 7.0.1 or later (for 7.0.x). Patches are available via the stable kernel tree at kernel.org. Prioritize patching systems that use hugetlb memory features or run userfaultfd-based applications. No configuration-based workaround has been published; upgrading to a fixed kernel version is the only recommended remediation (Github Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system and published a security advisory page. Amazon Linux 2023 has also issued a security advisory (ALAS2023-2026-1816) addressing this CVE. SUSE has published a security update (SUSE-SU-2026:22048-1) covering this issue. No notable independent researcher commentary or significant social media discussion has been identified (Red Hat Bugzilla).