CVE-2026-31575

{"id": "CVE-2026-31575", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31575", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:34.682609Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3", "lessThan": "5a525c43baaba0bf3063f86996ca3623b71e4172", "versionType": "git"}, {"status": "affected", "version": "a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3", "lessThan": "574501ede47ac439afd67ba9812bc66722d500ba", "versionType": "git"}, {"status": "affected", "version": "a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3", "lessThan": "08282b1bf74c69fc8ecd25493e7fdb5460f01290", "versionType": "git"}, {"status": "affected", "version": "a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3", "lessThan": "f4689fc089765d36c026063fb22d23533e883eb6", "versionType": "git"}, {"status": "affected", "version": "a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3", "lessThan": "0217c7fb4de4a40cee667eb21901f3204effe5ac", "versionType": "git"}], "programFiles": ["include/linux/hugetlb.h", "mm/userfaultfd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.84", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/hugetlb.h", "mm/userfaultfd.c"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:32.123", "references": [{"url": "https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/userfaultfd: fix hugetlb fault mutex hash calculation\n\nIn mfill_atomic_hugetlb(), linear_page_index() is used to calculate the\npage index for hugetlb_fault_mutex_hash(). However, linear_page_index()\nreturns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()\nexpects the index in huge page units. This mismatch means that different\naddresses within the same huge page can produce different hash values,\nleading to the use of different mutexes for the same huge page. This can\ncause races between faulting threads, which can corrupt the reservation\nmap and trigger the BUG_ON in resv_map_release().\n\nFix this by introducing hugetlb_linear_page_index(), which returns the\npage index in huge page granularity, and using it in place of\nlinear_page_index()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/userfaultfd: corrige el c\u00e1lculo del hash del mutex de fallo de hugetlb\n\nEn mfill_atomic_hugetlb(), se utiliza linear_page_index() para calcular el \u00edndice de p\u00e1gina para hugetlb_fault_mutex_hash(). Sin embargo, linear_page_index() devuelve el \u00edndice en unidades PAGE_SIZE, mientras que hugetlb_fault_mutex_hash() espera el \u00edndice en unidades de p\u00e1gina enorme. Esta discrepancia significa que diferentes direcciones dentro de la misma p\u00e1gina enorme pueden producir diferentes valores hash, lo que lleva al uso de diferentes mutexes para la misma p\u00e1gina enorme. Esto puede causar condiciones de carrera entre hilos con fallos, lo que puede corromper el mapa de reserva y activar el BUG_ON en resv_map_release().\n\nSe corrige esto introduciendo hugetlb_linear_page_index(), que devuelve el \u00edndice de p\u00e1gina con granularidad de p\u00e1gina enorme, y us\u00e1ndolo en lugar de linear_page_index()."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BC7BB9E-B7C1-413D-9B8D-BE033C486508", "versionEndExcluding": "6.12.84"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}