Description

In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete their virtqueues via vdev->config->del_vqs(). However, page reporting work (page_reporting_process) was scheduled on the global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM freezer skips it, leaving page_reporting_process active during suspend. If pages are freed into the buddy allocator while suspending (for example, when core MM invokes the balloon shrinker during S4 hibernation image saving), page reporting triggers virtballoon_free_page_report() on deleted virtqueues, resulting in a Use-After-Free / General Protection Fault: [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI [ 196.825967] Workqueue: events page_reporting_process [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring] [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon] [ 196.946943] page_reporting_process+0x370/0x4f0 Fix this by switching page reporting work to system_freezable_wq. This ensures that the PM freezer pauses page_reporting_process before device drivers destroy their reporting virtqueues. Because the reporting worker is frozen, memory reclamation/freeing (e.g. via shrinker execution) can safely return pages to MM during freeze without triggering unfrozen reporting work on deleted virtqueues. This aligns with the driver's existing design. The comment in virtballoon_freeze() states: /* * The workqueue is already frozen by the PM core before this * function is called. */ Testing: I have verified these fixes using Google’s virtualization infrastructure by running continuous suspend/resume iterations (40+ cycles) while churning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60% --timeout 1`) to constantly create free pages for the buddy allocator. We also set the `page_reporting_order` parameter to 0 to make the page reporting worker highly sensitive, forcing it to pick up any 4K free pages. This confirmed that the UAF crashes are no longer reproducible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:52.930Z",
  "pubdate": "2026-08-15T13:17:52.930Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel memory management and virtualization subsystem, specifically within the page reporting mechanism interacting with virtio-balloon drivers. The vulnerability type is a concurrency and lifecycle synchronization flaw during power management states. The impact includes system crashes, kernel panics, General Protection Faults, and potential denial of service or arbitrary code execution vectors under specific memory corruption scenarios. The affected systems include Linux kernel environments utilizing memory page reporting alongside virtio-balloon device drivers during power management operations like S3 suspend or S4 hibernation. The risk implications involve stability degradation and unexpected node termination in virtualized environments. Attacker capabilities are constrained, as exploitation requires the ability to trigger power management suspend or hibernation cycles while simultaneously generating memory pressure and heap allocations during device driver teardown. No special network exposure or authentication is required, as the conditions rely on local kernel execution paths and timing windows during state transitions.",
  "technicalDetails": "The root cause of the vulnerability stems from improper workqueue scheduling during power management freeze states. Specifically, the page reporting work item (page_reporting_process) was scheduled on the global non-freezable system_wq workqueue instead of a freezable alternative such as system_freezable_wq. During system suspend (S3) or hibernation (S4) image saving, device drivers like virtio_balloon execute teardown routines such as vdev->config->del_vqs() to reset underlying virtio devices and delete their virtqueues. Because system_wq lacks the WQ_FREEZABLE flag, the PM freezer bypasses it, leaving the page_reporting_process active and executing concurrently with device de-initialization. Step-by-step exploitation or accidental triggering occurs when core memory management invokes balloon shrinkers during suspend state transitions (e.g., S4 hibernation image saving), which frees pages into the buddy allocator. This asynchronous action triggers the page_reporting_process to execute virtballoon_free_page_report() against virtio_balloon data structures. However, because the virtqueues have already been deleted by the device driver during the freeze sequence, accessing the freed or invalid memory region results in a Use-After-Free condition and a subsequent General Protection Fault or kernel panic within routines like virtqueue_add_split+0x233/0x4c0. The vulnerable component is the mm/page_reporting.c module interacting with drivers/virtio/virtio_balloon.c. The issue affects Linux kernel versions where page reporting utilizes the unfreezable global workqueue. No network exposure is required, and privilege requirements are constrained to local execution or trigger conditions capable of initiating power management states and memory reclamation routines."
}