Description
In the Linux kernel, the following vulnerability has been resolved:
mm/memfd: fix information leak in hugetlb folios
When allocating hugetlb folios for memfd, three initialization steps are
missing:
1. Folios are not zeroed, leading to kernel memory disclosure to userspace
2. Folios are not marked uptodate before adding to page cache
3. hugetlb_fault_mutex is not taken before hugetlb_add_to_page_cache()
The memfd allocation path bypasses the normal page fault handler
(hugetlb_no_page) which would handle all of these initialization steps.
This is problematic especially for udmabuf use cases where folios are
pinned and directly accessed by userspace via DMA.
Fix by matching the initialization pattern used in hugetlb_no_page():
- Zero the folio using folio_zero_user() which is optimized for huge pages
- Mark it uptodate with folio_mark_uptodate()
- Take hugetlb_fault_mutex before adding to page cache to prevent races
The folio_zero_user() change also fixes a potential security issue where
uninitialized kernel memory could be disclosed to userspace through read()
or mmap() operations on the memfd.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.11 | 6.12.61 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.17.11-1 | — |
| Debian 13 | linux | 6.12.63-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | linux | 6.17.0-19.19 | USN-8094-1 |
| Ubuntu 25.10 | linux-aws +2 | 6.17.0-1009.9 | USN-8094-1 |
| Ubuntu 25.10 | linux-azure +1 | 6.17.0-1010.10 | USN-8094-5, USN-8094-4 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1008.9 | USN-8094-2 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-19.19.1 | — |
| Ubuntu 24.04 LTS | linux-aws-6.17 | 6.17.0-1009.9~24.04.2 | USN-8094-1 |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1010.10~24.04.1 | USN-8094-4 |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1009.9~24.04.3 | USN-8094-2 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-19.19~24.04.2 | USN-8094-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1018.18 | — |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1017.17 | USN-8152-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1009.9~24.04.1 | USN-8094-1 |
| Ubuntu 24.04 LTS | linux-riscv +18 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-6.17 | 6.17.0-19.19.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1008.9~24.04.1 | USN-8094-3 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.27.1 | SUSE-SU-2026:20931-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | SUSE-SU-2026:20931-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.27.1 | SUSE-SU-2026:20931-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | SUSE-SU-2026:20931-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | SUSE-SU-2026:20838-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.27.1 | SUSE-SU-2026:20873-1, SUSE-SU-2026:20838-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.27.1.160000.2.8 | openSUSE-SU-2026:20416-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.27.1 | openSUSE-SU-2026:20416-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.12.63-84.121 | 1:1.0-0.amzn2023 | ALAS2023-2026-1430 |
| Amazon Linux 2023 | perf6.12 +14 | 1:6.12.63-84.121.amzn2023 | ALAS2023-2026-1430 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-108.64.6.3.el10uek | ELSA-2026-50112 |
Advisories 13
- WID-SEC-2025-2868 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8094-1 linux, linux-aws, linux-aws-6.17, linux-gcp, linux-hwe-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8094-2 linux-gcp-6.17, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8152-1 linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8094-3 linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8094-4 linux-azure, linux-azure-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8094-5 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- SUSE-SU-2026:20873-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:20931-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 2, 2026
- openSUSE-SU-2026:20416-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 29, 2026
- SUSE-SU-2026:20838-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 28, 2026
- ELSA-2026-50112 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 20, 2026
- ALAS2023-2026-1430 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 18, 2026