---
id: CVE-2026-53207
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

  Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can
  trigger a recurs…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

  Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can
  trigger a recurs…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-667
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15.54, < 5.16'
  - 'linux_kernel >= 5.18.1, < 6.1.176'
  - 'linux_kernel >= 6.2, < 6.6.143'
  - 'linux_kernel >= 6.7, < 6.12.94'
  - 'linux_kernel >= 6.13, < 6.18.36'
  - 'linux_kernel >= 6.19, < 7.0.13'
  - linux_kernel = 5.18
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.13
published: '2026-06-25'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53207'
references:
  - url: 'https://git.kernel.org/stable/c/3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/77b73b54801ae7137479c141fd0473a491c1dc48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a33bfed648c10f5a1519981dbfad80841191edc8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bf7ba8f96c258c30393814491930ae4ecdc5fe5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd77a83915b07e2b0205adb284f08b39ae31dc4b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fc3ff42cb0cbf947e4600ae9761c3783760050e2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00095
epssPercentile: 0.00724
ingestedAt: '2026-07-03T13:02:28.028Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can
trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock
when racing with a concurrent unmap:

  thread#0                              thread#1
  --------                              --------
  madvise(folio, MADV_HWPOISON)
    -> poisons the folio successfully
  madvise(folio, MADV_HWPOISON)         unmap(folio)
    try_memory_failure_hugetlb
      get_huge_page_for_hwpoison
        spin_lock_irq(&hugetlb_lock)    <- held
        __get_huge_page_for_hwpoison
          hugetlb_update_hwpoison()
            -> MF_HUGETLB_FOLIO_PRE_POISONED
          goto out:
            folio_put()
              refcount: 1 -> 0
              free_huge_folio()
                spin_lock_irqsave(&hugetlb_lock)
                  -> AA DEADLOCK!

The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop
the GUP reference while the hugetlb_lock is still held by the hugetlb.c
wrapper get_huge_page_for_hwpoison().  If concurrent unmap has released
the page table mapping reference, folio_put() drops the folio refcount to
zero, triggering free_huge_folio() which attempts to re-acquire the
non-recursive hugetlb_lock.

Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper
into get_huge_page_for_hwpoison().  Place spin_unlock_irq() before the
folio_put() at the out: label so the folio is always released outside the
lock.

[akpm@linux-foundation.org: fix race, rename label per Miaohe]

## Affected

- `linux_kernel >= 5.15.54, < 5.16`
- `linux_kernel >= 5.18.1, < 6.1.176`
- `linux_kernel >= 6.2, < 6.6.143`
- `linux_kernel >= 6.7, < 6.12.94`
- `linux_kernel >= 6.13, < 6.18.36`
- `linux_kernel >= 6.19, < 7.0.13`
- `linux_kernel = 5.18`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.13`