From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-89987][MODERATE 7.0] mm/huge_memory: transfer the pmd dirty bit to the folio on zap [ Upstream Date: Wed, 16 Sep 2026 07:56:41 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-89987 X-AL-KERNEL-Priority: MODERATE 7.0 X-AL-KERNEL-Severity: MODERATE 7.0 X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: YES X-AL-KERNEL-ActionableScore: 5 X-AL-KERNEL-ActionableScore-Lower: 4 X-AL-KERNEL-Commit: effe3cc6d4fdd407457eb30f7b0ef094393f0d64 List-Id: CVE: CVE-2026-89987 Priority: MODERATE 7.0 AL-KERNEL base severity: MODERATE KPANIC flag: YES Patch: mm/huge_memory: transfer the pmd dirty bit to the folio on zap [ Upstream Commit: effe3cc6d4fdd407457eb30f7b0ef094393f0d64 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=effe3cc6d4fdd407457eb30f7b0ef094393f0d64 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89987 Analysis date: Wed, 16 Sep 2026 07:56:41 -0400 ActionableScore: 5 ActionableScore lower bound: 4 Actionable bucket: Actionable Moderate Manual review required: NO Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89987 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89987 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE 7.0 Manual review required: NO A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-89987 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-89987 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L';*CWE-664;CWE-665;CWE-754;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L';BEST CVSS score: '5.3';DESCR 'A data integrity flaw in the Linux huge PMD zap path can lose writes to MAP_SHARED tmpfs mappings when shmem THP is enabled and swap backed reclaim later removes the folio. The PMD dirty bit can be the only record that the 2MB folio was written after a read fault installed a writable PMD, but zap_huge_pmd_folio did not transfer that dirty state to the folio before unmapping. A local process can trigger the affected path by using a shared tmpfs mapping under the required configuration and causing unmap or process exit followed by reclaim. For the CVSS the PR:L is used because local user level code is required to create and access the mapping, while administrator setup may be needed to enable shmem THP or the relevant mount mode. The issue is not network reachable. Impact is silent data loss and integrity loss for affected tmpfs data, with possible application disruption, but there is no evidence of memory corruption or privilege escalation.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate (with actual score 5) YES WRITE OOB DANGER INIT UAF KERNEL_PANIC_PLUS_UAF HARDWARE TEST MEMORY DECREASED_TO_MODERATE_REGULAR_FROM_MODERATE7_BASED_ON_GUESSCVSS_AND_CIANNH KPANIC INCREASED_TO_MODERATE70_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN5 NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=5 ActionableScoreLower=4 PrimitiveClass=CLASS_B RealUAF=NO HostAdminRequired=NO NamespaceScopedPrivilege=NO ImportantCandidate=NO ManualReview=RECOMMENDED AutoDowngradeAllowed=NO 1. ActionableScore * Raw conservative score: 4 * Conservative score: 4 * Raw paranoid score: 5 * Paranoid score: 5 * Final recommended bucket: **Actionable Moderate**:: No floor or cap was applied. 2. Signal breakdown Conservative positive signals: * +1 Local unprivileged trigger. A local process can create and use a MAP_SHARED tmpfs mapping and can reach munmap or exit_mmap on the affected mapping when the system configuration permits shmem THP. * +1 Persistent silent data loss. The bug can discard modified tmpfs data and later return zeroed pages instead of the written contents. * +1 Important filesystem and memory-management path. The affected path is tmpfs or shmem THP plus reclaim and swap handling, not a purely cosmetic accounting bug. * +1 Active-state retirement consistency violation. A live PMD can contain the only dirty-state record, and zap_huge_pmd_folio retires the PMD without transferring that state to the folio. Paranoid additional signal: * +1 Higher integrity consequence. The lost data may be application state shared through /dev/shm or tmpfs across process generations, so the practical integrity impact can be significant even though there is no memory corruption or privilege escalation primitive. Non-awarded signals: * RealUAF not awarded. The patch does not establish use-after-free or stale post-lifetime object dereference. * Controlled reclaim or arbitrary write not demonstrated. * Privilege escalation not demonstrated. * Confidentiality impact not awarded. There is no disclosure path. * Strong LPE or strong exploitation leverage not awarded. The primitive is data loss from missing dirty-bit propagation, not attacker-controlled kernel corruption. * Remote reachability not awarded. The issue is triggered through local memory mappings and reclaim behavior. * Race penalty not applied. The issue is a deterministic state propagation omission, not a narrow timing race. * Rare configuration penalty not applied. shmem THP and swap are prerequisites, but the supplied context states real fleet exposure and does not establish a rare or physically constrained environment. 3. Reachability analysis The complete trigger is local. A local process can map tmpfs with MAP_SHARED, fault a PMD-sized shmem THP region, write through the mapping, unmap or exit, and later have reclaim remove the clean-looking folio. The affected behavior requires shmem THP to be enabled for tmpfs and requires swap-backed reclaim to make the data loss visible. Host administrator action may be needed to enable a relevant tmpfs huge mode or system THP policy, but once such configuration exists, the vulnerable operation itself is reachable by local user-level code. Therefore HostAdminRequired is NO for the vulnerable runtime path. This is not a namespace-scoped capability issue, and no CAP_NET_ADMIN or CAP_SYS_ADMIN operation is required for the ordinary mapping use itself. No network trigger is established. No special hardware is required. No race repeatability concern applies because the dirty-bit loss follows from normal PMD zap and reclaim ordering. 4. Primitive and severity interpretation The exact primitive is loss of dirty-state propagation from a PMD to the backing folio during zap_huge_pmd_folio. The PMD dirty bit may be the only record that a MAP_SHARED tmpfs THP folio was written. If that PMD is zapped without folio_mark_dirty, reclaim can treat the folio as clean and remove it without swap-out, causing later faults to return zeroed data. This is not active structured UAF and not fixed stale storage. It is an active VM and filesystem state consistency violation. There is no concrete repeated release or refcount operation. There is no first lifetime operation that may free an object followed by a second mutation through the same dangling reference. PrimitiveClass is CLASS_B because the patch establishes a meaningful active-state retirement and storage-integrity primitive, but not controlled memory corruption or authorization bypass. Demonstrated consequence is silent tmpfs data loss. Speculative consequences beyond application disruption are not scored. ImportantCandidate is NO because no LPE, arbitrary write, protected cross-owner file corruption, authorization bypass, or memory corruption primitive is established. AutoDowngradeAllowed is NO because automatic closure would miss a concrete persistent data-integrity failure in a core mm/tmpfs path that is actionable for affected configurations. Likely operational severity is actionable Moderate: not an Important-class exploitation primitive by itself, but serious enough for manual triage where shmem THP and swap are enabled. 5. One-sentence report phrase A missing dirty bit transfer in zap_huge_pmd_folio can silently lose writes to MAP_SHARED tmpfs THP mappings after unmap and reclaim, causing local data integrity loss without evidence of memory corruption or privilege escalation. 6. Manual review recommendation MANUAL CHECK RECOMMENDED Manual review is recommended because the issue causes real silent data loss in a core tmpfs and THP reclaim path, but it does not currently establish UAF, arbitrary write, privilege escalation, or a network attack surface. 7. Call-site confidence Call-site confidence: high ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: mm/huge_memory: transfer the pmd dirty bit to the folio on zap [ Upstream Commit: effe3cc6d4fdd407457eb30f7b0ef094393f0d64 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=effe3cc6d4fdd407457eb30f7b0ef094393f0d64 Changed files: mm/huge_memory.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=effe3cc6d4fdd407457eb30f7b0ef094393f0d64 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89987 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89987 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L The Best / paranoid CVSS score: 5.3 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: 4 Paranoid ActionableScore: 5 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: YES Published priority for this report (same as in Subject): MODERATE 7.0 These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).