LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46013: mm/memfd_luo: fix physical address conversion in put_folios cleanup

In the Linux kernel, the following vulnerability has been resolved: mm/memfd_luo: fix physical address conversion in put_folios cleanup In memfd_luo_retrieve_folios()'s put_folios cleanup path: 1. kho_restore_folio() expects a phys_addr_t (physical address) but receives a raw PFN (pfolio->pfn). This causes kho_restore_page() to check the wrong physical address (pfn << PAGE_SHIFT instead of the actual physical address). 2. This loop lacks the !pfolio->pfn check that exists in the main retrieval loop and memfd_luo_discard_folios(), which could incorrectly process sparse file holes where pfn=0. Fix by converting PFN to physical address with PFN_PHYS() and adding the !pfolio->pfn check, matching the pattern used elsewhere in this file. This issue was identified by the AI review. https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory-management cleanup bug in memfd_luo. The vulnerable path can check or restore the wrong physical page information, including sparse file holes. The public record does not provide a CVSS score, impact class, or exploitation evidence, so urgency depends on whether your kernels include this code and vendor fixes.

Executive priority

Handle through normal kernel vulnerability management unless vendor guidance raises severity. There is no CVSS score or exploitation evidence in the provided sources, but kernel memory-management defects deserve timely patch tracking because impact details may mature after publication.

Technical view

memfd_luo_retrieve_folios() passed a raw PFN to kho_restore_folio(), which expects a phys_addr_t, and missed a pfn=0 guard in cleanup handling. The fix converts PFN with PFN_PHYS() and skips empty folio entries, matching nearby logic in retrieval and discard paths.

Likely exposure

Exposure appears limited to Linux kernels containing the memfd_luo code path and the affected versions identified in the CVE data. The bundle lists Linux as affected and includes version data around 6.19, 7.0.4, and 7.1, but distro backport status must be verified per vendor package.

Exploitation context

The source bundle does not show active exploitation, KEV listing, public exploit availability, or a practical attack path. It says the issue was identified by AI review and fixed in Linux stable commits. Treat exploitation status as unproven, not absent.

Researcher notes

Evidence is narrow: the description identifies a cleanup-path address conversion bug and missing sparse-hole guard. No CWE, CVSS, exploitability analysis, or affected distro matrix is provided. Validate by patch presence and vendor advisories, not by attempting reproduction.

Mitigation direction

  • Check your Linux vendor advisory and kernel package changelog for this CVE.
  • Update to a kernel build containing the referenced stable fixes.
  • Prioritize systems running kernels that include memfd_luo functionality.
  • Track distribution backports instead of relying only on upstream version numbers.

Validation and detection

  • Inventory running kernel versions across affected Linux fleets.
  • Confirm vendor packages include one of the referenced stable fixes or equivalent backport.
  • Review kernel source/package changelogs for PFN_PHYS() and pfn=0 cleanup handling.
  • Document systems pending vendor clarification where version mapping is ambiguous.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46013 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb3749f174d686627f702234e64bad976dc432dbc, b3749f174d686627f702234e64bad976dc432dbcunaffected
LinuxLinux6.19, 0, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.