VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97945: Linux kernel · x86/mm: Fix user-space data loss with MADV_FREE and THP

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f7491d7c81db0e7c304a7bd757a76d2fbeaff80e : patch Linux kernel soon.

Data as of 26 Oct 2026, 13:47 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f7491d7c81db0e7c304a7bd757a76d2fbeaff80e, e4d569fe2f436a9b58c048fefabf56eab68c1b7e, b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ bb3aadf7d446aaf22c725b274e2c194ac5cb2111, < f7491d7c81db0e7c304a7bd757a76d2fbeaff80e	Fixed in f7491d7c81db0e7c304a7bd757a76d2fbeaff80e
LinuxLinux	Affected ≥ bb3aadf7d446aaf22c725b274e2c194ac5cb2111, < e4d569fe2f436a9b58c048fefabf56eab68c1b7e	Fixed in e4d569fe2f436a9b58c048fefabf56eab68c1b7e
LinuxLinux	Affected ≥ bb3aadf7d446aaf22c725b274e2c194ac5cb2111, < b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2	Fixed in b5dec6dfb593d81fec15ba43c4fe5d58f10a49a2
LinuxLinux	Affected ≥ bb3aadf7d446aaf22c725b274e2c194ac5cb2111, < a5ad97cbcfcec31430268441c10eedde73200177	Fixed in a5ad97cbcfcec31430268441c10eedde73200177
LinuxLinux	Affected ≥ bb3aadf7d446aaf22c725b274e2c194ac5cb2111, < 55ddbc2ca6d5db64d44c3fb8f8705b4d39eb30b7	Fixed in 55ddbc2ca6d5db64d44c3fb8f8705b4d39eb30b7
LinuxLinux	Affected =6.6	Fixed in–

AI-suggested

A fix has been implemented and is available in the Linux kernel. The patch preserves the hardware dirty bit in pmd_modify(), aligning its behavior with pte_modify() and pud_modify(). Users should update to a fixed kernel version containing the commits identified by the provided fixedVersions hashes. No additional mitigation is required once the kernel is updated.

Description

A vulnerability in the Linux kernel's x86 memory management subsystem causes user-space data loss when using MADV_FREE with Transparent Huge Pages (THP). The issue arises because pmd_modify() improperly clears the hardware dirty bit, leading to data being mistakenly freed under memory pressure despite being rewritten. This affects both anonymous and file-backed THPs, causing potential loss of production data in affected environments.

Impact

The vulnerability can cause user-space applications to lose data silently when using MADV_FREE on PMD-mapped THPs under memory pressure or NUMA hinting. Data that was rewritten after MADV_FREE may be discarded prematurely because the kernel incorrectly clears the dirty bit, leading to zeroed pages being faulted in subsequently. This has been observed to cause production data loss in real-world use cases such as with the Polars data analytics library.

Summary

CVE-2026-97945 addresses a flaw in the Linux kernel's x86 memory management where pmd_modify() clears the hardware dirty bit incorrectly during operations involving MADV_FREE and Transparent Huge Pages (THP). This causes the kernel to lose track of dirty pages that have been rewritten after MADV_FREE, leading to premature freeing of memory pages under reclaim pressure. The problem stems from pmd_modify() masking out the _PAGE_DIRTY bit, unlike similar functions pte_modify() and pud_modify(). The fix involves preserving the _PAGE_DIRTY bit in pmd_modify(), ensuring proper tracking of dirty pages and preventing data loss.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:23 UTC

Technical details

References

Community reviews

Related threats