CVE-2026-63950

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the try to unmap one() function within the memory management subsystem. The nr pages variable is not properly initialized at the start of each loop iteration. This allows a value computed by a previous folio unmap pte batch() call to be reused in subsequent iterations where the function is not called again. This can lead to the corruption of folio refcount and mapcount, resulting in a kernel crash. The issue is triggered when using madvise(MADV FREE) on a large anonymous folio and making the last page device-exclusive via HMM DMIRROR EXCLUSIVE during node reclaim.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.