CVE-2026-53108: Linux Kernel PowerPC64 Race Condition Denial of Service

Technical summary

CVE-2026-53108 addresses a synchronization race in the PowerPC 64-bit kernel page table management, specifically in the handling of THP (transparent huge page) migration entries. The vulnerability occurs in the pmdp_huge_get_and_clear_full() function when a PMD entry transitions through a migration swap state. Thread A initiates folio migration via move_pages(), setting a migration entry and leaving the PMD in a state where pmd_present() returns true while pmd_none() returns false. Concurrently, Thread B executes munmap(), which interprets this intermediate state as a valid huge page and invokes zap_huge_pmd(). When the lock is acquired, pmdp_huge_get_and_clear_full() encounters a VM_BUG_ON assertion failure because the PMD no longer satisfies the expected presence condition. This race window exists between pmdp_invalidate() and the completion of page copying during migration. The issue also affects device-private THP migration paths enabled by commit a30b48bf1b24.

Business impact

This vulnerability enables a local denial of service attack on PowerPC 64-bit Linux systems. An attacker with local user privileges can crash the kernel by coordinating memory operations, resulting in system downtime and potential data loss if workloads are not gracefully recovered. For organizations running HPC, cloud infrastructure, or containerized services on PowerPC64 systems, kernel panics degrade availability and may trigger cascading failures. The low complexity of triggering the race (basic syscalls) relative to CVSS scoring reflects the moderate exploitation barrier, though the impact is severe for affected environments.

Affected systems

The vulnerability affects the Linux kernel on PowerPC 64-bit architectures (powerpc64le and powerpc64). Systems running kernels with transparent huge page migration support are in scope. The vulnerability does not affect x86 or other architectures. Affected versions span a range of kernel releases prior to the fix commit; consult the vendor advisory to identify the specific patched kernel version for your distribution. Organizations should prioritize systems running RHEL/CentOS on PowerPC64, Debian/Ubuntu on ppc64el, or other distributions on this architecture.

Exploitability

Exploitation requires local user-level access and the ability to execute syscalls. An attacker must reliably create a race condition between move_pages() and munmap() on the same memory range, which demands timing precision but requires no elevated privileges or complex techniques. The race window is narrow but reproducible under load or with deliberate coordination. No public exploit code exists (KEV status: not listed), reducing the immediate risk from automated attack tools. However, proof-of-concept triggering has been demonstrated during kernel development, indicating the condition is practically exploitable.

Remediation

Remediation requires applying a kernel patch that serializes or eliminates the race condition in the migration entry handling. The fix modifies the check in pmdp_huge_get_and_clear_full() or related code to safely handle the intermediate migration entry state. Organizations should verify the specific patch commit hash against their kernel version. Updates are typically delivered through distribution kernel updates (e.g., kernel-ml, kernel security updates). In the interim, environments can mitigate risk by disabling transparent huge page migration if operationally feasible, though this may impact performance.

Patch guidance

Obtain the patched kernel version from your Linux distribution's security channel. For RHEL/CentOS, check errata advisories; for Debian/Ubuntu, monitor security-tracker and security.ubuntu.com. Verify the kernel build includes the fix to pmdp_huge_get_and_clear_full() or the migration entry handling in arch/powerpc/mm/book3s64/pgtable.c. After patching, perform a test reboot to confirm system stability and monitor for any performance regressions. If running containers or virtualization, update the host kernel; guest kernels may require separate patching depending on your stack.

Detection guidance

Monitor system logs (dmesg, journalctl) for kernel BUG messages referencing pmdp_huge_get_and_clear_full() or VM_BUG_ON failures in pgtable.c around line 187 on PowerPC64 systems. Unscheduled kernel panics on PowerPC64 systems during memory-intensive workloads or after running move_pages() operations may indicate exploitation. Set up alerting for kernel oops and panic events. Correlation of munmap() syscall activity with page migration operations in process accounting logs may reveal suspicious patterns, though this requires detailed tracing.

Why prioritize this

Prioritize patching PowerPC64 systems due to the direct path to kernel panic (denial of service) requiring only local access. While CVSS 4.7 reflects moderate severity, the practical impact on availability for affected platforms justifies prioritization ahead of higher-scored vulnerabilities affecting fewer systems. Organizations without PowerPC64 infrastructure can deprioritize, though patches should be applied during routine kernel updates to maintain defense in depth.

Risk score, explained

CVSS 4.7 (MEDIUM) is driven by: (1) local attack vector requiring no network access; (2) high attack complexity reflecting the narrow race window and timing requirements; (3) low privilege requirement (standard user); (4) no impact on confidentiality or integrity; (5) high availability impact (kernel crash). The score appropriately reflects that while triggering requires some effort and local access, successful exploitation causes complete denial of service.

Frequently asked questions