Subject mm: fix UAF caused by race between ptdump and vmap pgtable freeing
Author ljs@kernel.org
Date 2026-07-17 17:30:07 +0000 UTC
Version
Cc akpm@linux-foundation.org bp@alien8.de bpf@vger.kernel.org catalin.marinas@arm.com dave.hansen@linux.intel.com david@kernel.org den@virtuozzo.com dev.jain@arm.com devnexen@gmail.com hpa@zytor.com kas@kernel.org liam@infradead.org linux-arm-kernel@lists.infradead.org linux-kernel@vger.kernel.org linux-mm@kvack.org ljs@kernel.org luto@kernel.org mhocko@suse.com mingo@redhat.com peterz@infradead.org rppt@kernel.org ryan.roberts@arm.com shakeel.butt@linux.dev stable@vger.kernel.org surenb@google.com syzbot@syzkaller.appspotmail.com tglx@kernel.org toshi.kani@hpe.com urezki@gmail.com vbabka@kernel.org will@kernel.org x86@kernel.org
Patches (5)
Name Content [All]
[PATCH mm-hotfixes v5 1/5] mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF [Body]
[PATCH mm-hotfixes v5 2/5] x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF [Body]
[PATCH mm-hotfixes v5 3/5] x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF [Body]
[PATCH mm-hotfixes v5 4/5] mm/ptdump: always stabilise against page table freeing using init_mm [Body]
[PATCH mm-hotfixes v5 5/5] arm64: remove redundant concurrent ptdump UAF mitigation [Body]
Series Summary
Passed
✓ All tests passed. No findings.
Sessions
Session 2026-07-17
Passed
ID (for dev) 0149f968-0a46-456d-bec9-3f65ffa8d159
Status finished
Triaged OK [Log] [Trajectory]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] passed [Log]
[KASAN] Boot test: Base fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] passed [Log]
[KASAN] Build Patched fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] [patched] passed [Log]
[KASAN] Boot test: Patched fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] [patched] passed [Log]
[KASAN] Fuzz fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] fce2dfa773ced15f27dd27cd0b482a7473cdcf2a [Config] [patched] passed [Log] [Artifacts]