CVE-2026-72174 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, system administrators, and users of Linux-based systems, especially those responsible for managing and securing Linux environments, should be aware of this vulnerability and take necessary actions to mitigate its impact. This includes reviewing and updating Linux kernel configurations to ensure hugetlb VMAs are properly handled and monitoring system logs for potential denial-of-service attempts. Additionally, Linux distribution maintainers and security teams should prioritize applying the kernel patch to fix the hugetlb self-deadlock vulnerability. Users of Linux-based systems should also be aware of the potential risks and take steps to protect their systems, such as keeping their kernels up-to-date and applying security patches promptly. Furthermore, security teams and vulnerability management professionals should assess the potential impact of this vulnerability on their organization's Linux-based systems and take proactive measures to mitigate its effects. This may involve conducting vulnerability scans, reviewing system configurations, and implementing compensating controls to reduce the risk of exploitation. By taking these steps, Linux kernel developers, maintainers, and users can help prevent potential attacks and ensure the security and stability of their systems. The vulnerability's impact can be mitigated by applying the kernel patch, reviewing and updating Linux kernel configurations, and monitoring system logs for potential denial-of-service attempts. Linux kernel developers and maintainers should prioritize fixing the hugetlb self-deadlock vulnerability to prevent potential attacks. System administrators and users of Linux-based systems should also take necessary precautions to protect their systems from potential exploitation. This includes keeping their kernels up-to-date, applying security patches promptly, and monitoring system logs for potential security incidents. By working together, Linux kernel developers, maintainers, and users can help prevent potential attacks and ensure the security and stability of Linux-based systems. Linux kernel developers and maintainers should also consider providing more

Technical summary

The Linux kernel vulnerability causes a self-deadlock in pagemap_scan_pte_hole() when handling PAGEMAP_SCAN ioctl requests on hugetlb VMAs. The issue arises when the scan encounters an unpopulated part of the range, causing the thread to hang unkillably. The vulnerability is resolved by faulting in the page table and installing the uffd-wp marker directly with make_uffd_wp_huge_pte() under the page-table lock.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to fix the hugetlb self-deadlock vulnerability
• Review and update Linux kernel configurations to ensure hugetlb VMAs are properly handled
• Monitor system logs for potential denial-of-service attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a self-deadlock in pagemap_scan_pte_hole() when handling PAGEMAP_SCAN ioctl requests on hugetlb VMAs. The issue is resolved by faulting in the page table and installing the uffd-wp marker directly with make_uffd_wp_huge_pte() under the page-table lock, rather than routing through uffd_wp_range().

Official resources