The vulnerability (CVE-2026-72180) affects the Linux kernel's huge memory management code. Specifically, change_non_present_huge_pmd() fails to carry the pmd_swp_uffd_wp() bit when downgrading a device-private PMD swap entry from writable to readable. This contrasts with the correct handling in change_softleaf_pte() and copy_huge_pmd(). Without preserving this bit, a mprotect() call on a UFFD_WP-marked device-private transparent huge page can remove the write-protect bit, allowing the userfaultfd trap to be bypassed upon swap-in. The issue has been fixed by modifying change_non_present_huge_pmd() to preserve the pmd_swp_uffd_wp() bit, matching the behavior of related functions.

The vulnerability allows bypassing the userfaultfd write-protect trap on device-private transparent huge pages during swap-in operations. This could potentially undermine memory protection mechanisms relying on userfaultfd write-protection, possibly leading to unauthorized memory modifications or bypass of expected memory access controls. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to preserve the pmd_swp_uffd_wp() bit in the affected function. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or vendor patches for the exact fixed versions and update accordingly.