CVE-2026-72043 Linux CVE debrief

Who should care

Linux kernel developers, LoongArch users, administrators of systems using the affected kernel versions, and security teams responsible for vulnerability management should be aware of this issue. They should assess their exposure, apply the patch, and monitor for potential data corruption issues. This includes reviewing system configurations, updating documentation, and ensuring proper testing and validation of the fix in their environments. Additionally, defenders should verify the patch implementation and perform thorough testing to ensure the vulnerability is fully mitigated. Those responsible for asset inventory and change management should also prioritize this update to prevent potential exploitation. The LTP madvise09 test case can be used to verify the fix and ensure that the patch does not introduce any regressions. Furthermore, monitoring and detection teams should be aware of the potential for data corruption and have processes in place to quickly respond to and contain any incidents that may arise. By taking these steps, organizations can minimize the risk associated with this vulnerability and ensure the security and integrity of their systems. This requires coordination between development, operations, and security teams to ensure a comprehensive approach to mitigation and remediation. The fix should be applied as soon as possible to prevent potential data corruption and ensure the continued security and stability of affected systems. A thorough review of system configurations and patch implementation should be conducted to ensure that the fix is properly applied and that no additional issues are introduced. This includes verifying that the patch is correctly applied, testing the system to ensure that the vulnerability is fully mitigated, and monitoring the system for any potential issues that may arise. By following these steps, organizations can ensure that their systems are secure and that the risk associated with this vulnerability is minimized. The affected vendors should also provide clear guidance on patch application and verification to ensure that customers can properly mitigate the vulnerability. This guidance should include detailed steps,

Technical summary

The Linux kernel has a vulnerability in LoongArch, where the missing dirty page tracking in pte/pmd_wrprotect() can cause data corruption. The fix propagates the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits. This ensures the software dirty tracking bit is preserved across fork COW write-protection. The issue was found by the LTP madvise09 test case, which exercises page reclaim after 'madvise(MADV_FREE), write and fork' operation sequence on private anonymous mappings. Affected Linux kernel developers should apply the patch and verify the fix using the LTP madvise09 test case.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to fix the missing dirty page tracking in pte/pmd_wrprotect()
• Use LTP madvise09 test case to verify the fix
• Monitor for potential data corruption issues
• Perform a thorough review of system configurations to ensure the patch is properly applied
• Verify the patch implementation and perform thorough testing to ensure the vulnerability is fully mitigated
• Update documentation to reflect the changes made to the system
• Track exceptions and retest remediated assets to ensure the fix is effective

Evidence notes

The issue was found by the LTP madvise09 test case, which exercises page reclaim after 'madvise(MADV_FREE), write and fork' operation sequence on private anonymous mappings. The fix propagates the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.