CVE-2026-53189

mm/huge_memory: update file PMD counter before folio_put()

State: Published
Severity: 7.8 High
Published: Jun 25, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: update file PMD counter before folio_put()

__split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked().

Move the counter update before folio_put().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	fadae2953072e9005c5f1d64e1049edb043494dc to before 84b3212b166b446faea27ebebb7161405ffceef9Affected fadae2953072e9005c5f1d64e1049edb043494dc to before 108963978a681c0c468d279cac2b930c27672877Affected fadae2953072e9005c5f1d64e1049edb043494dc to before 459771c9cf30f378bdbd30fc65d17f7eb931bb59Affected fadae2953072e9005c5f1d64e1049edb043494dc to before ae9d4caf6f133e884cf5fcda4982c493b35e5194Affected fadae2953072e9005c5f1d64e1049edb043494dc to before 6c29a8ba084e89499ca77b947e07ae817f9c16ceAffected fadae2953072e9005c5f1d64e1049edb043494dc to before 5f5b604e1e6bde4e889199168ee80fe8306d06adAffected fadae2953072e9005c5f1d64e1049edb043494dc to before ed5b030931292c94133437ac5e5ff580e498eabdAffected fadae2953072e9005c5f1d64e1049edb043494dc to before 8d878059924f12c1bc24556a92ec56add74de3c8Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

fadae2953072e9005c5f1d64e1049edb043494dc to before 84b3212b166b446faea27ebebb7161405ffceef9Affected
fadae2953072e9005c5f1d64e1049edb043494dc to before 108963978a681c0c468d279cac2b930c27672877Affected
fadae2953072e9005c5f1d64e1049edb043494dc to before 459771c9cf30f378bdbd30fc65d17f7eb931bb59Affected
fadae2953072e9005c5f1d64e1049edb043494dc to before ae9d4caf6f133e884cf5fcda4982c493b35e5194Affected
fadae2953072e9005c5f1d64e1049edb043494dc to before 6c29a8ba084e89499ca77b947e07ae817f9c16ceAffected
fadae2953072e9005c5f1d64e1049edb043494dc to before 5f5b604e1e6bde4e889199168ee80fe8306d06adAffected
fadae2953072e9005c5f1d64e1049edb043494dc to before ed5b030931292c94133437ac5e5ff580e498eabdAffected
fadae2953072e9005c5f1d64e1049edb043494dc to before 8d878059924f12c1bc24556a92ec56add74de3c8Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.