PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63950 Linux CVE debrief

A vulnerability was found in the Linux kernel's memory management subsystem, specifically in the try_to_unmap_one function. The bug occurs due to the improper initialization of the nr_pages variable, which can lead to potential refcount/mapcount corruption when a 64K large folio is mmaped with MAP_ANONYMOUS | MAP_DROPPABLE, and then madvise(MADV_FREE) is called, followed by making the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE. This issue was resolved by initializing nr_pages to 1 at the start of each loop iteration in try_to_unmap_one. The vulnerability was introduced by lazyfree folio batching, and device-exclusive only works for anonymous folios. Linux kernel developers, maintainers, and users who rely on the Linux kernel for their systems should be aware of this issue and take necessary actions.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers, maintainers, and users who rely on the Linux kernel for their systems should be aware of this issue and take necessary actions to apply the official patch and review the patched Linux kernel version.

Technical summary

The vulnerability is caused by the improper initialization of the nr_pages variable in the try_to_unmap_one function. This can lead to refcount/mapcount corruption when a 64K large folio is mmaped with MAP_ANONYMOUS | MAP_DROPPABLE, and then madvise(MADV_FREE) is called, followed by making the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE. The bug was introduced by lazyfree folio batching, and device-exclusive only works for anonymous folios. The issue was resolved by initializing nr_pages to 1 at the start of each loop iteration in try_to_unmap_one.

Defensive priority

High

Recommended defensive actions

  • Apply the official patch to initialize nr_pages to 1 at loop start in try_to_unmap_one
  • Review and test the patched Linux kernel version
  • Monitor system logs for potential issues related to folio_referenced_one and try_to_unmap_one
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by initializing nr_pages to 1 at the start of each loop iteration in try_to_unmap_one. The bug was introduced by lazyfree folio batching, and device-exclusive only works for anonymous folios. The userspace visible effect is simply kernel crashing somewhere due to refcount/mapcount corruption. The source confidence is limited, and defenders should verify the patched Linux kernel version.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:13.730Z and has not been modified since then.