PT-2026-34371 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-31466

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19-rc1

Description A race condition exists between mTHP splitting and the zap nonpresent ptes() function on arm64 servers. The issue occurs in the softleaf to folio() function due to a missing memory barrier (smp rmb()). This can lead to a situation where a folio obtained from a migration entry is not properly locked, potentially causing a folio to undergo modification without the required lock being held.

Recommendations Update to Linux kernel version 6.19-rc1 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-31466

ECHO-2E27-ABFC-AD07

Affected Products

Linux Kernel

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-31466 · Security Note
• https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 · Patch
• https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8 · Patch
• https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31466 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31466 · Vendor Advisory
• https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31466 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31466 · Vendor Advisory
• https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31466 · Vendor Advisory
• https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31466 · Vendor Advisory
• https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd · Patch
• https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41 · Patch