Loading story…
Linux maintainers patched an x86 kernel defect that can silently discard rewritten user-space data under a specific combination of transparent huge pages, cgroup memory limits, MADV_FREE, and heavy memory-reclaim pressure. The flaw, present since Linux 6.6, occurs when pmd_modify() fails to retain the hardware dirty bit during certain memory-protection or NUMA-placement changes; reclaim can then treat live pages as disposable and return zero-filled data instead.
The issue has caused production data loss, including reports from users of the Polars data analytics library. A one-line correction preserving the dirty state was committed on September 9 and merged via the x86 urgent tree after Linux 7.3-rc3, with backports planned for supported stable kernel series. Available reporting indicates an integrity defect rather than malicious exploitation; organizations running affected kernels should prioritize stable updates, particularly on workloads using transparent huge pages and memory-constrained cgroups.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The x86/urgent merge path brought the correction into Linux mainline following the Linux 7.3-rc3 release. The fix was also marked for backporting to supported stable kernel series.
A one-line fix preserving the hardware dirty value in pmd_modify() was committed to prevent reclaim from discarding rewritten huge-page memory as clean.
The issue was reported with a small C proof of concept after being linked to production data loss, including Polars users receiving zero-filled memory in place of rewritten data. The failure required MADV_FREE, PMD-mapped transparent huge pages, subsequent writes and page-table changes, and memory-reclaim pressure.
A defect in the x86 pmd_modify() helper was introduced, allowing PMD page-table changes to lose the hardware dirty bit needed for correct transparent-huge-page reclaim decisions. The bug affected kernel releases beginning with Linux 6.6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-21727** is a use-after-free flaw in the Linux kernel's `padata` parallel-data processing subsystem, affecting `padata_reorder()` in `kernel/padata.c`. When a cryptographic algorithm is removed while reorder processing is still running, one thread can free a reference-counted parallel-data object while another accesses it through `padata_find_next()`, causing a kernel crash, denial of service, or potential privilege escalation. The vulnerability was introduced in Linux kernel 5.4 and is reproducible with the LTP `pcrypt_aead01` test. The upstream fix adds `synchronize_rcu()` to `padata_free_shell()` so serial-processing operations finish before the affected object is released. Patched upstream releases include Linux 6.1.129, 6.6.76, 6.12.13, 6.13.2, and 6.14-rc1; Red Hat has also released fixes across multiple Red Hat Enterprise Linux kernel packages and update streams. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.0, while the CVE record assigns a 7.8 score.
Aug 26, 2026
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing **x86 page-fault handling** logic flaw and newly optimized **page-cache side-channel** techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 `do_page_fault()` path could leave **hardware interrupts** enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into **Linux 6.19** with plans to backport to stable branches. Separately, researchers from Graz University of Technology described significantly faster Linux **page cache attacks**, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only **CVE-2025-21691** has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated **GPU DDK** issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Jun 29, 2026
**CVE-2023-0597** affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive. The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
Aug 26, 2026