CVE-2026-53109: PowerPC Linux Kernel Page Table Fragment Memory Corruption

Technical summary

The vulnerability exists in PowerPC's page table fragment management, specifically in the interaction between pte_free_defer() (which defers PTE table freeing via RCU) and pte_frag_destroy() (invoked during process exit). On PowerPC systems using Hash MMU with 64K page size, page tables are divided into 16 fragments of 4K each. The pte_free_defer() function sets the active flag on fragment folios and decrements pt_frag_refcount. When refcount reaches zero, the code should conditionally call RCU-deferred freeing or immediate freeing based on the active flag state. However, when pte_frag_destroy() is called from the do_exit() path on a process with cached fragments, it unconditionally calls pagetable_dtor() and pagetable_free() without clearing the active flag first. This leaves the folio with the active flag set while being freed, violating kernel page state invariants and triggering the kernel's bad page detection mechanism. The root cause is a missing flag clear operation before final deallocation in the exit path.

Business impact

Organizations running PowerPC-based Linux systems in production environments (such as IBM Power Systems) face potential service interruptions. Affected workloads may experience sudden kernel panics during process termination, causing data loss, interrupted batch jobs, and unplanned downtime. The impact is most significant for deployments using memory-intensive applications or those with frequent process churn. However, the vulnerability is limited to PowerPC architecture and requires specific page table configurations (Hash MMU with 64K pages), limiting scope compared to x86-dominant infrastructures. Enterprise support contracts with Linux vendors will be critical for rapid patch deployment.

Affected systems

Linux kernels on PowerPC architecture are affected, specifically versions that include the deferred page table freeing patch series. Affected configurations require Hash MMU (not Radix) and 64K page size. Systems at risk include IBM Power9 and Power10 servers running distributions with recent kernel updates. The vulnerability does not affect x86, ARM, or other non-PowerPC architectures. Verify your kernel version and PowerPC MMU configuration against vendor advisories to determine exposure.

Exploitability

Exploitation requires local code execution on the target system with user-level privileges. An attacker cannot trigger this remotely or from an unprivileged context. The attack vector is straightforward: running a crafted user-space program designed to allocate page table fragments and then exit under conditions that trigger the bad state condition. No special kernel capabilities or elevated privileges are needed to trigger the crash itself, though the impact (denial of service via kernel panic) affects the entire system. The low complexity and lack of interaction requirements make this practical for local attackers.

Remediation

Apply kernel patches that restore proper active flag management in pte_frag_destroy(). The fix involves adding a clear_bit() operation to unset the active flag on the folio before calling pagetable_dtor() and pagetable_free() in the exit path. Consult your Linux vendor or distribution's security advisories for patch availability and version numbers. Organizations should prioritize kernel updates on PowerPC systems, especially those running madvise MADV_COLLAPSE workloads or memory-intensive applications. Testing patches in staging environments before production rollout is recommended to catch any interactions with custom kernels or out-of-tree modules.

Patch guidance

Kernel maintainers should prioritize patch development for affected kernel branches. The fix is targeted to the PowerPC pgtable-frag code path and should have minimal risk of regressions. Distributors should backport patches to stable/LTS kernel branches and release updates through their normal security channels. For users: monitor your vendor's security advisories (Red Hat, SUSE, IBM, Canonical) for kernel updates addressing this CVE. Apply patches during scheduled maintenance windows. Verify patch application by checking kernel version and running system validation tests to confirm page table behavior.

Detection guidance

Monitor system logs for "BUG: Bad page state" messages combined with stack traces mentioning pte_frag_destroy() or arch_exit_mmap(). Systems vulnerable to this issue will show characteristic kernel panic logs with PAGE_FLAGS_CHECK_AT_FREE flag errors. Check kernel version against patched releases provided by your vendor. Organizations using kernel introspection tools can inspect pt_frag_refcount values and folio active flags during normal operation to establish baselines; deviations may indicate vulnerability exploitation or environmental issues. Enable kernel debugging (CONFIG_DEBUG_PAGEALLOC) on non-production systems to catch related issues early.

Why prioritize this

Despite a CVSS 7.8 rating, this vulnerability should be prioritized based on deployment footprint rather than raw score. PowerPC systems represent a smaller attack surface than x86 environments, but they are often critical infrastructure (financial services, enterprise HPC, government). The combination of local attack surface and system-wide crash impact makes this HIGH priority for affected organizations. Prioritize based on: (1) presence of PowerPC infrastructure, (2) reliance on high-uptime SLAs, (3) deployment of recent kernels with MADV_COLLAPSE support. Organizations without PowerPC systems can defer action but should monitor for backported fixes in x86-targeted CVEs that may have related root causes.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH severity) reflects high impact (crash/DoS affecting confidentiality, integrity, availability) combined with low attack complexity and low privileges required. The score appropriately penalizes the local-only attack vector. However, the score does not account for limited affected population (PowerPC only), which in real-world risk assessment would lower practical severity for x86-dominant enterprises. The lack of KEV status and active exploitation signals currently indicates this is pre-mitigation intelligence; threat actors may target PowerPC systems once patches are public and exploitation methods are documented.

Frequently asked questions