The Linux kernel vulnerability CVE-2026-23375 involves the Transparent Huge Pages (THP) feature incorrectly allowing THP for files on anonymous inodes created via alloc_file_pseudo(), which do not increment inode->i_writecount and appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled. This misclassification makes them eligible for THP collapse, although they should be excluded since CONFIG_READ_ONLY_THP_FOR_FS targets real filesystem files. The flaw could allow khugepaged and MADV_COLLAPSE to create large folios in the page cache via the collapse path on these pseudo-files, potentially impacting system stability or behavior. The issue has been fixed in Linux kernel versions 6.8.0 and later, with patches available in Ubuntu kernel updates. The fix excludes anonymous inodes from THP eligibility, aligning behavior with the intended design.

The vulnerability does not affect confidentiality or integrity but has an impact on availability, as indicated by the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). It could lead to denial of service or system instability due to improper handling of Transparent Huge Pages on anonymous inodes. No known exploits are reported in the wild. The impact is limited to local attackers with low privileges and requires local access.

A patch is available and has been released by the vendor. Users should update their Linux kernel to the fixed versions (6.8.0 and later) as provided by their distribution, such as through Ubuntu security notices USN-8567-1 and USN-8574-1. After applying the update, a system reboot is required to activate the fixes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure complete remediation.