The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mm/huge_memory: use correct flags for device private PMD entry Commit 65edfda6f3f2 (mm/rmap: extend rmap     and migration support device-private entries) updated set_pmd_migration_entry() to use     pmdp_huge_get_and_clear() in the softleaf case, but made no further adjustments to the function itself.
    Therefore this function continues to incorrectly use pmd_write(), pmd_soft_dirty() and pmd_uffd_wp() to     determine whether the installed migration entry should be marked writable, softdirty or uffd-wp     respectively. Whilst all are incorrect, the most problematic of these is pmd_write(), as this can lead to     corrupted rmap state. On x86-64 _PAGE_SWP_SOFT_DIRTY is aliased to _PAGE_RW. So calling pmd_write() on a     softleaf will return the softdirty state encoded in the entry, assuming CONFIG_MEM_SOFT_DIRTY was enabled.
    This was observed when running the hmm.hmm_device_private.anon_write_child selftest: 1. The test faults in     a range then migrates it such that a device-private THP range is established. 2. The parent then migrates     it to a device-private writable PMD entry whose folio is entirely AnonExclusive with entire_mapcount=1,     softdirty set (accidentally correct write state). 3. The parent forks and the PMD entries are set to     device-private read only entries, entire_mapcount=2, softdirty still set. 4. [BUG] The child writes to the     range then migrates to RAM - intending to install non-writable migration entries - but replacing parent     and child PMD mappings with WRITABLE entries due to misinterpreting the softdirty bit. 5. In     remove_migration_pmd(), if !softleaf_is_migration_read(entry) we set the RMAP_EXCLUSIVE flag when calling     folio_add_anon_rmap_pmd() for both parent and child, which are therefore AnonExclusive. 6. [SPLAT] Child     sets migrated folio entire_mapcount=1, parent sets entire_mapcount=2 and we end up with an AnonExclusive     folio with entire_mapcount=2! Assert fires in __folio_add_anon_rmap():
    VM_WARN_ON_FOLIO(folio_test_large(folio) && folio_entire_mapcount(folio) > 1 &&     PageAnonExclusive(cur_page), folio) This patch fixes the issue by correctly referencing the softleaf entry     fields for writable, softdirty and uffd-wp in set_pmd_migration_entry(). It also only updates A/D flags if     the entry is present as these are otherwise not meaningful for a softleaf entry. This patch also flips the     if (!present) { ... } else { ... } logic in set_pmd_migration_entry() so it is easier to understand, and     adds some comments to make things clearer. I was able to bisect this to commit 775465fd26a3     (lib/test_hmm: add zone device private THP test infrastructure) which first exposes this bug as it was     the commit that permitted test_hmm to generate the test. However commit 65edfda6f3f2 (mm/rmap: extend     rmap and migration support device-private entries) is the commit that actually enabled this behaviour.
    (CVE-2026-53155)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-53155

medium Nessus Plugin ID 323485

Version 1.6