CVE-2026-46013

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1

Description An issue exists in the put folios cleanup path of the memfd luo retrieve folios() function. The kho restore folio() function expects a physical address but receives a raw Page Frame Number (PFN) via pfolio->pfn, leading kho restore page() to verify an incorrect physical address. Additionally, the loop fails to check for !pfolio->pfn, which may result in the incorrect processing of sparse file holes where the PFN is zero.

Recommendations For the Linux kernel, convert the PFN to a physical address using PFN PHYS() and implement the !pfolio->pfn check within the cleanup loop. Update openSUSE Tumbleweed to kernel-devel-7.0.11-1.1.