The vulnerability (CVE-2026-31575) in the Linux kernel's mm/userfaultfd subsystem was caused by incorrect calculation of the hugetlb fault mutex hash. The function mfill_atomic_hugetlb() used linear_page_index(), which returns page indices in PAGE_SIZE units, while hugetlb_fault_mutex_hash() expects indices in huge page units. This discrepancy allowed different addresses within the same huge page to hash to different mutexes, leading to race conditions between threads handling faults on the same huge page. These races could corrupt the reservation map and cause kernel BUG_ON triggers in resv_map_release(). The issue was fixed by introducing hugetlb_linear_page_index() to correctly calculate indices in huge page granularity and replacing linear_page_index() with it. The vulnerability affects multiple Linux kernel versions prior to 6.8.0 and related builds. The fix is included in updated kernel packages as per the Ubuntu security advisories USN-8488-1 and USN-8488-2.

The vulnerability can cause race conditions between faulting threads on the same huge page, leading to corruption of the reservation map and kernel crashes (BUG_ON triggers). This results in denial of service via system instability or crashes. There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack with low complexity and privileges required, no user interaction, and impact limited to availability (denial of service). No known exploits in the wild have been reported.

An official patch is available and included in updated Linux kernel packages. Users should apply the kernel updates provided by their distribution (e.g., Ubuntu) and reboot the system to activate the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating and rebooting. No additional mitigations are necessary once the patch is applied.