Linux Kernel Hugetlb PMD Page Table Refcount Vulnerability

A vulnerability in the Linux kernel's handling of hugetlb memory can lead to a page table leak. The issue arises because the folio reference count may be unexpectedly increased by functions like split_huge_pages. This incorrect refcounting can cause the page table to be improperly managed, leading to a 'Bad page state' error. The vulnerability is present in version 6.13.0-rc2 and may be triggered by various processes that increase the reference count of the page table.

Impact

Exploitation of this vulnerability can cause a page table leak, where the page table is discarded after reporting a 'nonzero mapcount', but the associated HugeTLB page is not freed, leading to a resource leak.