---
id: CVE-2026-53189
title: 'mm/huge_memory: update file PMD counter before folio_put()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/huge_memory: update file PMD counter before folio_put()

  __split_huge_pmd_locked() updates the file/shmem RSS counter after
  dropping the PMD mapping's folio referenc…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    84b3212b166b446faea27ebebb7161405ffceef9
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    108963978a681c0c468d279cac2b930c27672877
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    459771c9cf30f378bdbd30fc65d17f7eb931bb59
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    ae9d4caf6f133e884cf5fcda4982c493b35e5194
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    6c29a8ba084e89499ca77b947e07ae817f9c16ce
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    5f5b604e1e6bde4e889199168ee80fe8306d06ad
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    ed5b030931292c94133437ac5e5ff580e498eabd
  - >-
    Linux >= fadae2953072e9005c5f1d64e1049edb043494dc <
    8d878059924f12c1bc24556a92ec56add74de3c8
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:26:30.336469Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:36.027Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53189'
references:
  - url: 'https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9'
  - url: 'https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877'
  - url: 'https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59'
  - url: 'https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194'
  - url: 'https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce'
  - url: 'https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad'
  - url: 'https://git.kernel.org/stable/c/ed5b030931292c94133437ac5e5ff580e498eabd'
  - url: 'https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02275
ingestedAt: '2026-10-16T17:24:46.734Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: update file PMD counter before folio_put()

__split_huge_pmd_locked() updates the file/shmem RSS counter after
dropping the PMD mapping's folio reference.  If folio_put() drops the last
reference, mm_counter_file() can later read freed folio state via
folio_test_swapbacked().

Move the counter update before folio_put().

## Affected

- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 84b3212b166b446faea27ebebb7161405ffceef9`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 108963978a681c0c468d279cac2b930c27672877`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 459771c9cf30f378bdbd30fc65d17f7eb931bb59`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < ae9d4caf6f133e884cf5fcda4982c493b35e5194`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 6c29a8ba084e89499ca77b947e07ae817f9c16ce`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 5f5b604e1e6bde4e889199168ee80fe8306d06ad`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < ed5b030931292c94133437ac5e5ff580e498eabd`
- `Linux >= fadae2953072e9005c5f1d64e1049edb043494dc < 8d878059924f12c1bc24556a92ec56add74de3c8`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.