CVE-2026-72412

The _PAGE_UNUSED softbit in Linux kernel page tables is the root of CVE-2026-72412, and understanding what it actually is matters more than the CVSS score suggests. _PAGE_UNUSED is a purely software construct—no hardware enforces it, no type system tracks it, and critically, no owner document defines its lifetime semantics. KVM on s390 adopted this bit as a cross-subsystem signal: when unmapping a guest page that is no longer in use, KVM sets _PAGE_UNUSED on the corresponding userspace PTE, expecting the core mm layer to treat this as a persistent hint that the page can be discarded rather than migrated or swapped. The core mm code never agreed to this contract. The bit was invented for try_to_unmap_one() to identify discardable pages, and no PTE setter path was instructed to clear it when re-presenting a present entry. The vulnerability manifests as silent guest memory corruption, not a crash. When a page with _PAGE_UNUSED set is reclaimed, returned to the general memory pool, and later reused for a different guest page, the stale softbit can cause the page to be treated as discardable when it should be valid. The guest continues running on poisoned data with no hypervisor assertion, no host crash, and no obvious error—the corruption is purely semantic and low-and-slow. The fix clears _PAGE_UNUSED in set_pte() for present PTEs, effectively making the core mm layer the implicit owner of PTE state coherence. A companion fix in gmap_helper_try_set_pte_unused() constrains the bit to present PTEs only. Together these changes establish a new invariant: _PAGE_UNUSED cannot survive a set_pte() call on a present entry. The EPSS score for this CVE is low despite CRITICAL severity, and that discrepancy should not reassure defenders. The s390 attack surface is concentrated—mainframes and specific cloud providers—and the exploitation window is not uniform. Workloads with high page churn (databases, in-memory processing) against shared hosts create conditions where the reuse window activates more frequently than the marginal probability suggests. The EPSS model cannot capture this conditional concentration. More importantly, this is not a one-off oversight. The softbit lifecycle pattern—invented for one narrow contract, adopted by a second subsystem without negotiation, implicitly managed by whoever touched the PTE last—has produced _PAGE_SPECIAL corruption bugs and _PAGE_SOFT_DIRTY issues in migration paths. The fix closes this specific gap but does not close the class. Teams running s390 KVM in multi-tenant environments should treat this as higher priority than the probability score indicates, not because exploitation is trivial, but because the detection surface is essentially nonexistent and the corruption channel operates below every safeguard the kernel has built.

Reviewed through automated stages and approved by a human before publication.