CVE-2026-63950

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous folio_unmap_pte_batch() call can be reused on a later iteration that does not run folio_unmap_pte_batch() again. mmap a 64K large folio with MAP_ANONYMOUS | MAP_DROPPABLE, then call madvise(MADV_FREE), then make the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE. Trigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will first clear the first 15 out of 16 entries mapping the lazyfree folio. This will set nr_pages to 15. In the next pvmw walk, this nr_pages gets reused on a device-exclusive pte, thus potentially corrupting folio refcount/mapcount. At the moment, I have a userspace program which can make the kernel spit out a trace, but the blow up is in folio_referenced_one(), because there are existing bugs in the interaction between device-private and rmap (which too I am investigating). I did a one liner kernel change to avoid going into folio_referenced_one(), and the kernel blows up at folio_remove_rmap_ptes in try_to_unmap_one which is what I wanted. Note that the bug is there not since file folio batching but lazyfree folio batching, since device-exclusive only works for anonymous folios. Userspace visible effect is simply kernel crashing somewhere due to refcount/mapcount corruption.

• CWE-476

• https://git.kernel.org/stable/c/0fcc34d0d8fefca4fea349e45c10e3a3d90350ebPatch
• https://git.kernel.org/stable/c/3f8968e9cbf95d5d87d32218906cab0b9b9eddbePatch
• https://git.kernel.org/stable/c/f611db9b771b2b6775357555d2517af044fca4f0Patch

Published

Jul 19, 2026

Last Modified

Oct 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63945In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-63946In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-63947In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-63948In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-63949In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-6395The Word 2 Cash plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-63951In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-63952In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-63953In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-63954In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-63955In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-63956In the Linux kernel, the following vulnerability has been re…7.8