CVE-2026-72412
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix handling of _PAGE_UNUSED pte bit
The _PAGE_UNUSED softbit should not really be lying around. Its sole purpose is to signal to try_to_unmap_one() and try_to_migrate_one() that the page can be discarded instead of being moved / swapped.
KVM has no way to know why a page is being unmapped, so it sets the bit on userspace ptes corresponding to unused guest pages every time they get unmapped. KVM has no reasonable way to clear the bit once the page is in use again.
While set_ptes() checks and clears the bit, other paths that set new ptes did not. This led to used pages being thrown out as if they were unused, causing guest corruption.
Fix the issue by clearing the _PAGE_UNUSED bit for present ptes in set_pte(), i.e. whenever a present pte is getting set. The check in set_ptes() is then redundant and can be removed.
Also fix gmap_helper_try_set_pte_unused() to only set the bit if the pte is present; the _PAGE_UNUSED bit is only defined for present ptes and thus should not be set for non-present ptes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's s390 architecture memory management subsystem, specifically concerning the handling of the _PAGE_UNUSED page table entry bit. This issue stems from a fundamental flaw in how the kernel manages memory mappings for virtual pages, particularly within the context of KVM hypervisor operations on IBM System/390 systems. The _PAGE_UNUSED softbit serves as a signaling mechanism between kernel memory management functions and the page migration subsystem, indicating when pages can be safely discarded rather than moved or swapped during memory reclamation processes. This bit is critical for maintaining data integrity during memory operations, yet its improper handling has created a scenario where legitimate active pages are incorrectly treated as unused.
The technical flaw manifests in the inconsistent application of the _PAGE_UNUSED bit clearing mechanism across different kernel code paths that modify page table entries. While the set_ptes() function correctly checks for and clears this bit, other code paths responsible for setting new page table entries fail to perform this crucial cleanup operation. This inconsistency creates a race condition where pages that have been unmapped by KVM for guest memory management purposes retain the _PAGE_UNUSED bit set, even after they become active again. KVM's inability to properly track when pages transition from unused to used states exacerbates this issue since it cannot reliably clear the bit once pages resume active usage, leading to a persistent state where valid memory mappings are incorrectly marked as eligible for discard.
The operational impact of this vulnerability extends beyond simple memory management inefficiencies to potentially cause severe guest system corruption. When the kernel encounters pages with the _PAGE_UNUSED bit set during memory operations, it incorrectly assumes these pages are unused and proceeds to discard them rather than preserving their contents. This misbehavior specifically affects KVM virtual machines where guest pages may be unmapped and remapped multiple times during normal operation, creating a high probability of data loss or system instability. The vulnerability essentially allows for the premature deallocation of memory that should remain accessible, leading to potential application crashes, data corruption, or complete system hangs depending on the nature of the affected memory regions.
The fix implemented addresses this issue by ensuring consistent bit handling across all page table entry setting operations within the kernel's memory management subsystem. Specifically, the solution modifies the set_pte() function to always clear the _PAGE_UNUSED bit for present page table entries whenever they are being set, thereby preventing the accumulation of stale bit states in active memory mappings. This approach eliminates the redundant check previously present in set_ptes() since the more comprehensive clearing mechanism now covers all relevant code paths. Additionally, the fix strengthens the gmap_helper_try_set_pte_unused() function to validate that the _PAGE_UNUSED bit is only applied to present page table entries, as this bit is specifically defined for active memory mappings and should not be set on non-present entries. This remediation aligns with established security practices by ensuring proper state management in kernel memory subsystems and prevents potential exploitation scenarios where malicious actors could manipulate memory states through carefully crafted page table modifications.
This vulnerability demonstrates characteristics consistent with CWE-129 Improper Validation and CWE-362 Concurrency Issues, as the improper bit handling creates both validation gaps in memory state representation and race conditions during concurrent memory management operations. The fix addresses these concerns by establishing proper synchronization of memory state flags across all kernel memory management paths, ensuring that page table entry states accurately reflect actual memory usage patterns. From an ATT&CK perspective, this vulnerability relates to T1059 Command and Scripting Interpreter and T1486 Data Encrypted for Impact, as improper memory management can lead to data corruption scenarios where guest system data becomes inaccessible due to premature deallocation of active pages, effectively creating a form of data encryption through deletion that impacts system functionality.