CVE-2026-64181: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64181 is a Linux kernel memory management vulnerability affecting the __vm_normal_page() function, specifically its handling of missing pmd_special()/pud_special() support on x86 32-bit architectures with Transparent Huge Pages (THP) enabled. The flaw causes incorrect page state tracking, triggering kernel warnings and BUG conditions. It was published on July 19, 2026, and affects Linux kernel versions starting from commit af38538801c6 through the 6.18.x and 7.0.x stable series. The CVSS category is estimated as Medium (GitHub Advisory, Feedly).

The root cause is an architectural oversight introduced in commit af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") and further exposed by commit d80a9cb1a64a ("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"). On x86 32-bit systems, pmd_special() and pmd_mkspecial() are gated by CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on 32-bit architectures — unlike pte_special()/pte_mkspecial() which use the dedicated CONFIG_ARCH_HAS_PTE_SPECIAL. As a result, the _PAGE_SPECIAL bit is never set in the huge zero PMD, causing zap_huge_pmd() to trigger VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)) in mm/memory.c:735. The fix teaches vm_normal_page_pmd()/vm_normal_page_pud() to check whether pmd_special/pud_special is actually implemented before relying on it (GitHub Advisory).

Exploitation of this vulnerability on affected systems results in incorrect RSS counter states ("BUG: Bad rss-counter state") and corrupted page states ("BUG: Bad page state") when the memory reclaim path calls shrink_huge_zero_folio_scan(). Additionally, the huge zero folio is incorrectly accounted in smaps, pagemap (PAGE_IS_FILE), and numamaps as file-backed THP, and folio_walk_start() may return the folio even without FW_ZEROPAGE set. These conditions primarily affect system stability and memory accounting integrity on x86 32-bit Linux systems with THP enabled, and do not appear to directly enable remote code execution or privilege escalation (GitHub Advisory).

Patches have been committed to the Linux kernel stable tree. Fixed commits are 62153767e8fc3889bc6508e9ffe927aaf64c4334, 9052ea2ee2233be5d4786b8909151ca2bfbedf99, and c0c6ccd9828c3a1950623b546fa57292a77b5c73, targeting the 6.18.x and 7.0.x stable branches (unaffected from 6.18.34 and 7.0.11 onward, and 7.1+). Administrators running x86 32-bit Linux kernels with THP enabled should apply the relevant stable kernel update. As a temporary workaround, disabling Transparent Huge Pages (echo never > /sys/kernel/mm/transparent_hugepage/enabled) can prevent the vulnerable code path from being triggered (GitHub Advisory).