CVE-2026-31648: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31648 is an integer overflow vulnerability in the Linux kernel's filemap_map_pages() function within the memory management subsystem (mm/filemap.c). The flaw arises from a race condition between concurrent file truncation and memory-mapped I/O operations, causing the nr_pages calculation to overflow and leading to kernel crashes and memory corruption. It was published on April 24, 2026, and affects Linux kernel versions from 6.1.159 up through multiple stable branches, including 6.6.x before 6.6.135, 6.12.x before 6.12.82, 6.13–6.18.x before 6.18.23, 6.19.x before 6.19.13, and 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in the nr_pages calculation within filemap_map_pages(). The race condition occurs when one CPU is executing filemap_map_pages() — retrieving a large folio via next_uptodate_folio() using the old inode->i_size — while a second CPU concurrently shrinks the file via ext4_setattr() (calling i_size_write()). After the file size is reduced, end_pgoff is recalculated using the new, smaller i_size, which can result in xas.xa_index > end_pgoff. The subsequent computation nr_pages = min(end, end_pgoff) - xas.xa_index + 1 then wraps around to a very large value, causing set_pte_range() to attempt mapping pages far beyond the folio's actual boundary and corrupting page->_mapcount fields of unrelated pages. The fix moves the end_pgoff calculation to before the next_uptodate_folio() call, ensuring the retrieved folio is consistent with the file end (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes kernel memory corruption manifested as "Bad page state" panics, with incorrect refcount and mapcount values on affected pages, potentially leading to kernel crashes and system unavailability. The corruption of page metadata (e.g., page->_mapcount) can destabilize the entire system, affecting all processes and data on the host. While the CVSS score rates confidentiality, integrity, and availability impacts all as High, the primary real-world consequence is system instability and denial of service; privilege escalation to full kernel control is theoretically possible given the nature of the memory corruption but has not been demonstrated (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., an unprivileged user able to perform mmap() on files that are concurrently truncated), making it accessible to any local user on a multi-core system. The EPSS score is approximately 0.018% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Gain local access: Obtain a low-privileged local account on a system running an affected Linux kernel version (e.g., 6.6.x < 6.6.135, 6.12.x < 6.12.82, or 7.0-rc1 through rc7), preferably on a multi-core machine.
2. Set up a target file: Create a large file on an ext4 (or similar) filesystem that will be used for memory-mapped I/O.
3. Establish a memory mapping: In one thread/process, open the file and call mmap() to map it into the process address space, then trigger page faults to invoke filemap_map_pages() (e.g., by accessing mapped memory regions).
4. Concurrently truncate the file: In a second thread/process, simultaneously call truncate() or ftruncate() on the same file to shrink its size, triggering ext4_setattr() and i_size_write() on another CPU core.
5. Trigger the race: Repeat steps 3–4 rapidly (e.g., using stress-ng's --mmap or --mmaptorture stressor) to hit the race window where end_pgoff is recalculated with the new smaller i_size after the folio is retrieved with the old size.
6. Observe kernel crash: The nr_pages integer overflow causes set_pte_range() to map beyond the folio boundary, corrupting page->_mapcount of unrelated pages and triggering a "Bad page state" BUG or kernel panic (Github Advisory, Red Hat Bugzilla).

• Kernel Logs: Messages containing BUG: Bad page state in process <name> pfn:<address> with refcount:0 mapcount:1 in dmesg or /var/log/kern.log.
• Kernel Logs: WARNING at ./include/linux/rmap.h:351 in folio_add_file_rmap_ptes with call stack including set_pte_range, filemap_map_folio_range, filemap_map_pages, do_fault_around.
• Kernel Logs: VM_WARN_ON_FOLIO messages indicating page_folio(page + nr_pages - 1) != folio, signaling an out-of-bounds folio mapping attempt.
• Process Behavior: Unexpected crashes or hangs of processes performing concurrent mmap() and truncate() operations on the same files (e.g., stress-ng with --mmaptorture workload).
• System: Sudden kernel panics or system reboots on multi-core systems running workloads combining memory-mapped file I/O with file resizing operations (Github Advisory).

Update the Linux kernel to a patched stable version: 6.6.135 or later (6.6.x series), 6.12.82 or later (6.12.x series), 6.18.23 or later (6.13+ series), 6.19.13 or later (6.19.x series), or the final 7.0 release. Patches are available via the kernel stable tree at git.kernel.org (commits 576543be, 633ab680, 88591194, 9316a820, f58df566). As a temporary workaround until patching is possible, limit or avoid workloads that combine mmap() on files with concurrent truncation/resizing operations, particularly on ARM64 systems or high-core-count servers (Github Advisory, Red Hat Bugzilla).

Red Hat has tracked the vulnerability via Bugzilla (Bug 2461541) and assigned it a medium severity rating, with the upstream kernel advisory referenced at the linux-cve-announce mailing list. Tenable has published detection plugins (Nessus plugin 310508) for the vulnerability. No significant public researcher commentary or social media discussion beyond standard CVE tracking has been observed (Red Hat Bugzilla).