CVE-2026-64514 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: gate must_wait writability check on pte_present()
userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result.
The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive.
Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability in question affects the Linux kernel's userfaultfd implementation, specifically within the userfaultfd_must_wait() and userfaultfd_huge_must_wait() functions. This issue represents a race condition that occurs during memory management operations when the kernel attempts to determine whether a page fault should be blocked due to write protection. The flaw manifests in how these functions handle page table entries without proper synchronization mechanisms, creating potential for incorrect behavior during memory migration and swap operations.
The technical root cause lies in the improper access pattern of page table entries where the functions read PTE values without acquiring the necessary page table locks before applying pte_write() or huge_pte_write() accessors. These accessors decode bits from the present encoding but fail to account for non-present entry types such as swap or migration entries. When encountering these special entry types, the code incorrectly interprets offset bits that happen to occupy the same bit positions as write permission bits, resulting in undefined and potentially misleading return values.
This vulnerability operates under the context of memory management subsystem where userfaultfd serves as a mechanism allowing userspace applications to handle page faults asynchronously. The intended functionality of the writability check is to determine whether a fault should remain blocked due to write protection mechanisms. However, when dealing with non-marker swap entries that indicate pages in transit, the current implementation incorrectly assumes these entries represent active write-protected pages rather than temporary migration states.
The operational impact of this vulnerability can be severe as it may cause threads to remain indefinitely asleep waiting for userfaultfd wake notifications that will never arrive. This occurs because the garbage write bit interpretation leads the kernel to believe that write protection is still active when in reality the page is undergoing migration or swap operations. The affected code path essentially creates a deadlock scenario where legitimate memory operations cannot proceed properly.
The fix implements a gating mechanism that ensures the writability check only operates on present PTE bits when entries are actually present, as indicated by pte_present() checks. This lockless re-check approach prevents inspection of non-present or non-marker entry types that would otherwise produce undefined results. The solution aligns with common security practices for race condition prevention in kernel memory management, ensuring that operations only proceed when valid page table entries exist.
From a cybersecurity perspective, this vulnerability falls under CWE-362 (Concurrent Execution using Shared Resource with Unprotected Read-Write Access) and relates to ATT&CK technique T1059.007 (Command and Scripting Interpreter: PowerShell). The issue demonstrates the importance of proper synchronization in kernel space operations and highlights how seemingly minor race conditions can lead to significant system stability problems. This type of vulnerability represents a classic example of improper locking mechanisms in kernel code that can be exploited to cause denial-of-service conditions or potentially more severe impacts depending on system configuration.
The mitigation strategy focuses on implementing proper conditional checks before performing bit decoding operations, ensuring that all memory management operations only proceed when appropriate entry types are present. This approach prevents the kernel from making incorrect assumptions about page protection states during migration and swap operations, thereby maintaining system stability and preventing indefinite blocking scenarios in userfaultfd handling paths.
This vulnerability type is particularly relevant to systems where memory-intensive applications and virtualization technologies are prevalent, as these environments heavily utilize userfaultfd mechanisms for performance optimization. The fix demonstrates the critical nature of proper entry validation in kernel space programming, where incorrect assumptions about data structure contents can lead to system instability and security implications.