CVE-2026-43389

{"id": "CVE-2026-43389", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b3749f174d686627f702234e64bad976dc432dbc", "lessThan": "e901c871d4b592f0042e30f3a0f031eae79744ec", "versionType": "git"}, {"status": "affected", "version": "b3749f174d686627f702234e64bad976dc432dbc", "lessThan": "7e04bf1f33151a30e06a65b74b5f2c19fc2be128", "versionType": "git"}], "programFiles": ["mm/memfd_luo.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/memfd_luo.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T15:16:50.290", "references": [{"url": "https://git.kernel.org/stable/c/7e04bf1f33151a30e06a65b74b5f2c19fc2be128", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e901c871d4b592f0042e30f3a0f031eae79744ec", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: memfd_luo: always dirty all folios\n\nA dirty folio is one which has been written to. A clean folio is its\nopposite. Since a clean folio has no user data, it can be freed under\nmemory pressure.\n\nmemfd preservation with LUO saves the flag at preserve(). This is\nproblematic. The folio might get dirtied later. Saving it at freeze()\nalso doesn't work, since the dirty bit from PTE is normally synced at\nunmap and there might still be mappings of the file at freeze().\n\nTo see why this is a problem, say a folio is clean at preserve, but gets\ndirtied later. The serialized state of the folio will mark it as clean. \nAfter retrieve, the next kernel will see the folio as clean and might try\nto reclaim it under memory pressure. This will result in losing user\ndata.\n\nMark all folios of the file as dirty, and always set the\nMEMFD_LUO_FOLIO_DIRTY flag. This comes with the side effect of making all\nclean folios un-reclaimable. This is a cost that has to be paid for\nparticipants of live update. It is not expected to be a common use case\nto preserve a lot of clean folios anyway.\n\nSince the value of pfolio->flags is a constant now, drop the flags\nvariable and set it directly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm: memfd_luo: ensuciar siempre todos los folios\n\nUn folio sucio es aquel al que se le ha escrito. Un folio limpio es su opuesto. Dado que un folio limpio no tiene datos de usuario, puede ser liberado bajo presi\u00f3n de memoria.\n\nLa preservaci\u00f3n de memfd con LUO guarda el indicador en preserve(). Esto es problem\u00e1tico. El folio podr\u00eda ensuciarse m\u00e1s tarde. Guardarlo en freeze() tampoco funciona, ya que el bit de sucio del PTE se sincroniza normalmente al desmapear y a\u00fan podr\u00eda haber mapeos del archivo en freeze().\n\nPara ver por qu\u00e9 esto es un problema, digamos que un folio est\u00e1 limpio en preserve, pero se ensucia m\u00e1s tarde. El estado serializado del folio lo marcar\u00e1 como limpio. Despu\u00e9s de retrieve, el siguiente kernel ver\u00e1 el folio como limpio y podr\u00eda intentar reclamarlo bajo presi\u00f3n de memoria. Esto resultar\u00e1 en la p\u00e9rdida de datos de usuario.\n\nMarcar todos los folios del archivo como sucios, y establecer siempre el indicador MEMFD_LUO_FOLIO_DIRTY. Esto viene con el efecto secundario de hacer que todos los folios limpios no sean reclamables. Este es un costo que debe ser pagado por los participantes de la actualizaci\u00f3n en vivo. No se espera que sea un caso de uso com\u00fan preservar muchos folios limpios de todos modos.\n\nDado que el valor de pfolio -> flags es una constante ahora, eliminar la variable flags y establecerla directamente."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}