Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-72043— LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于LoongArch架构中pte_wrprotect()和pmd_wrprotect()未正确传播脏页标志位，可能导致数据损坏。

CVSS 7.1 · High EPSS 0.17% · P6

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 09cfefb7fa70c3af011b0db0a513fd80b2f18abc< 76f88650763a35cbf1384c65d66d096fa31cc58d affected
09cfefb7fa70c3af011b0db0a513fd80b2f18abc< e8a916579e427af32f2de8213dfa23c5df6e6664 affected
09cfefb7fa70c3af011b0db0a513fd80b2f18abc< 39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9 affected
09cfefb7fa70c3af011b0db0a513fd80b2f18abc< a65f49b6f7ece756394f8f0e85570020e7fd0e35 affected
09cfefb7fa70c3af011b0db0a513fd80b2f18abc< e483da960892c41fa7f0cf0d2fc2410d65a483d6 affected
09cfefb7fa70c3af011b0db0a513fd80b2f18abc< 018e9828eb523c638fa3d9bdf0fd4956b74555b2 affected
5.19 affected
< 5.19 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72043

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB miss, without going through the software TLB store handler. The software TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED together: ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED) Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. _PAGE_MODIFIED is left unchanged. This creates a window where a PTE has _PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED clear (software is unaware). When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and _PAGE_DIRTY bits: pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); Since _PAGE_MODIFIED was never set, the dirtiness information is lost completely. Subsequently, when memory pressure triggers page reclaim, page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() returns false) and the page may be freed without writeback, causing data corruption. Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: if (pte_val(pte) & _PAGE_DIRTY) pte_val(pte) |= _PAGE_MODIFIED; The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, where pmd entries need the same treatment. This ensures the software dirty tracking bit (checked by pte_dirty() and pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is preserved across fork COW write-protection. The issue was found by the LTP madvise09 test case, which exercises page reclaim after "madvise(MADV_FREE), write and fork" operation sequence on private anonymous mappings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于LoongArch架构中pte_wrprotect()和pmd_wrprotect()未正确传播脏页标志位，可能导致数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 09cfefb7fa70c3af011b0db0a513fd80b2f18abc ~ 76f88650763a35cbf1384c65d66d096fa31cc58d -
Linux Linux 5.19 -

II. Public POCs for CVE-2026-72043

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72043

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72043 (5)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72322 9.8 CRITICAL ipv6: mcast: Fix potential UAF in MLD delayed work
CVE-2026-72206 9.8 CRITICAL ntfs: validate index block header more strictly
CVE-2026-72429 9.8 CRITICAL ipv6: ioam: fix type confusion of dst_entry
CVE-2026-72129 9.8 CRITICAL nvmet-rdma: handle inline data with a nonzero offset
CVE-2026-72130 9.8 CRITICAL nvmet-auth: reject short AUTH_RECEIVE buffers
CVE-2026-72436 9.8 CRITICAL netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident
CVE-2026-72319 9.8 CRITICAL ipvs: ensure inner headers in ICMP errors are in headroom
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-74427 9.8 CRITICAL afs: Fix netns teardown to cancel the preallocation charger
CVE-2026-72137 9.8 CRITICAL xfrm: nat_keepalive: avoid double free on send error
CVE-2026-74376 9.8 CRITICAL md/raid10: reset read_slot when reusing r10bio for discard

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72043

No comments yet

Leave a comment