{"id":"CVE-2026-98507","aliases":[],"cve":{"records":[{"id":"CVE-2026-98507","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.354Z","published":"2026-10-18T15:17:13.767Z","modified":"2026-10-30T12:38:20.652Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:38:20.652Z"}],"references":[{"url":"https://git.kernel.org/stable/c/badedec499f6320742368c73fa77cd63dcf8ca55","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/aef0f69b515af1c8a4147f68a46b6b81854f46f7","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7d103fc7b836084af585d9d3471334624354cf26","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/465e222815c8839445d09028fa4c77e70f7f1c7d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a500df43cde075f6ea4b8bae495d89f2c35b3e16","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/4cef512a955e4008ae4436a4fc97726976df1fdf","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/d348a715380bfcc6a611bdf722169d53fd01e735","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b6ac0b3f6013c168f22cad97e79967accacb08e1","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.18.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.2.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G            E     5.10.0-0021.aarch64 #1\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01\nCall trace:\n __switch_to+0x7c/0xbc\n __schedule+0x3b4/0x8a0\n schedule+0x50/0xe0\n rwsem_down_write_slowpath+0x3cc/0x6cc\n down_write+0x60/0x260\n __anon_vma_prepare+0x6c/0x210\n do_anonymous_page+0x258/0x660\n handle_pte_fault+0x188/0x214\n __handle_mm_fault+0x1b0/0x380\n handle_mm_fault+0xf4/0x284\n do_page_fault+0x19c/0x494\n do_translation_fault+0xcc/0xf8\n do_mem_abort+0x48/0xac\n el0_da+0x44/0x80\n el0_sync_handler+0x88/0xb4\n el0_sync+0x160/0x180\n\nAfter analyzing the vmcore, we found the anon_vma->root->rwsem.count is\n-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the\nanon_vma->root->rwsem.owner shows the lock is held, but the stack of the\ntask shows the task doesn't hold the anon_vma lock.\n\nAfter adding more debugging info, we found __anon_vma_prepare() reuses\nanon_vma and triggers the UAF of anon_vma->root due to missing memory\nbarrier, leading to locking and unlocking two different anon_vma->root,\nthus leading to an anon_vma will never be unlocked, and another anon_vma\ncouldn't be locked anymore.\n\nThis race requires two adjacent VMAs that are not merged but are\nanon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be\nchanged by mprotect()).  Two threads fault on each VMA concurrently, both\ncalling __anon_vma_prepare() with only mmap_lock held for reading.\n\n    THREAD A                             THREAD B\n__anon_vma_prepare                __anon_vma_prepare\n find_mergeable_anon_vma() -> NULL\n anon_vma = anon_vma_alloc();\n   anon_vma->root = anon_vma;\n // the two stores may be reordered\n vma->anon_vma = anon_vma;\n                                   // finds A's anon_vma\n                                   anon_vma = find_mergeable_anon_vma(vma);\n                                   anon_vma_lock_write(anon_vma);\n                                     // may still see the old root\n                                     down_write(&anon_vma->root->rwsem);\n                                   anon_vma_unlock_write(anon_vma);\n                                     // see the new root, never unlock old\n                                     up_write(&anon_vma->root->rwsem);\n\nthread A triggers page fault and calls __anon_vma_prepare() to prepare\nanon_vma for the faulting vma.  __anon_vma_prepare() allocates and\ninitializes a new anon_vma, and then publishes it to the vma with a plain\nstore.  anon_vma_prepare() only requires the mmap_lock to be held for\nreading, so two threads can fault on adjacent VMAs at the same time. \nWhile thread A publishes a new anon_vma, thread B could find the anon_vma\nvia find_mergeable_anon_vma() and then locks anon_vma->root->rwsem.\n\nThe store to anon_vma->root in anon_vma_alloc() and the store to\nvma->anon_vma can be reordered.  The anon_vma_lock_write() and spin_lock()\nonly provide acquire semantics, which do not prevent prior stores from\nbeing reordered after them.  The release semantics of the corresponding\nspin_unlock() and anon_vma_unlock_write() come too late, the store to\nvma->anon_vma is already published before they take effect.  As a result,\nthread B can observe the following order:\n\n    vma->anon_vma = anon_vma;\n    anon_vma->root = anon_vma;\n\nThe anon_vma slab is SLAB_TYPESAFE_BY_RCU, so a newly allocated anon_vma\nmay reuse memory from a previously freed one.  The constructor\n(anon_vma_ctor) does not reset anon_vma->root, and __put_anon_vma()\ndoesn't clear it either, so the old root value persists until\nanon_vma_alloc() overwrites it.  If that store isn't v\n---truncated---","score":7.8,"severity":"high","published":"2026-10-18T15:17:13.767Z","modified":"2026-10-30T12:38:20.652Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"badedec499f6320742368c73fa77cd63dcf8ca55","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"aef0f69b515af1c8a4147f68a46b6b81854f46f7","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"7d103fc7b836084af585d9d3471334624354cf26","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"465e222815c8839445d09028fa4c77e70f7f1c7d","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"a500df43cde075f6ea4b8bae495d89f2c35b3e16","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"4cef512a955e4008ae4436a4fc97726976df1fdf","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"d348a715380bfcc6a611bdf722169d53fd01e735","versionType":"git"},{"version":"5c341ee1dfc8fe69d66b1c8b19e463c6d7201ae1","status":"affected","lessThan":"b6ac0b3f6013c168f22cad97e79967accacb08e1","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98507"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.55","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.9","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98507"}],"remediation":[],"references":["https://git.kernel.org/stable/c/badedec499f6320742368c73fa77cd63dcf8ca55","https://git.kernel.org/stable/c/aef0f69b515af1c8a4147f68a46b6b81854f46f7","https://git.kernel.org/stable/c/7d103fc7b836084af585d9d3471334624354cf26","https://git.kernel.org/stable/c/465e222815c8839445d09028fa4c77e70f7f1c7d","https://git.kernel.org/stable/c/a500df43cde075f6ea4b8bae495d89f2c35b3e16","https://git.kernel.org/stable/c/4cef512a955e4008ae4436a4fc97726976df1fdf","https://git.kernel.org/stable/c/d348a715380bfcc6a611bdf722169d53fd01e735","https://git.kernel.org/stable/c/b6ac0b3f6013c168f22cad97e79967accacb08e1"],"sources":[{"name":"CVE","id":"CVE-2026-98507","modified":"2026-10-30T12:38:20.652Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98507"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T14:01:41.065Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:00:32.916Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}