Description
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix handling of _PAGE_UNUSED pte bit
The _PAGE_UNUSED softbit should not really be lying around. Its sole
purpose is to signal to try_to_unmap_one() and try_to_migrate_one()
that the page can be discarded instead of being moved / swapped.
KVM has no way to know why a page is being unmapped, so it sets the bit
on userspace ptes corresponding to unused guest pages every time they
get unmapped. KVM has no reasonable way to clear the bit once the page
is in use again.
While set_ptes() checks and clears the bit, other paths that set new
ptes did not. This led to used pages being thrown out as if they were
unused, causing guest corruption.
Fix the issue by clearing the _PAGE_UNUSED bit for present ptes in
set_pte(), i.e. whenever a present pte is getting set. The check in
set_ptes() is then redundant and can be removed.
Also fix gmap_helper_try_set_pte_unused() to only set the bit if the
pte is present; the _PAGE_UNUSED bit is only defined for present ptes
and thus should not be set for non-present ptes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 7.0 | 7.1.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | linux | 7.0.0-34.34 | USN-8816-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1013.13 | USN-8816-2, USN-8816-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1017.17 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1016.16 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1007.8 | USN-8816-4 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1014.14 | USN-8816-2, USN-8816-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1025.26 | USN-9043-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2022.23 | USN-9003-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1012.12 | USN-8816-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1020.20 | USN-8816-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-34.34.1 | USN-8816-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 +1 | 7.0.0-1013.13~24.04.1 | USN-8816-2, USN-8816-1 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1017.17~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1016.16~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-34.34~24.04.1 | USN-8816-1 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1024.25~24.04.1 | USN-9003-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1012.12~24.04.1 | USN-8816-3 |
| Ubuntu 24.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-34.34.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
Advisories 9
- USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9043-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8888-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- WID-SEC-2026-2852 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8816-1 linux, linux-aws, linux-aws-7.0, linux-hwe-7.0, linux-ibm, linux-oracle, linux-raspi, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8816-2 linux-gcp, linux-gcp-7.0, linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8816-4 linux-gke vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8816-3 linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026