# CVE-2026-72043: linux: In the Linux kernel, the following vulnerability has been resolved:  LoongArch: Fix missing dirty page tracking in {p...

CVE-2026-72043 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-72043, released August 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-72043
- Priority: High
- CVSS: 7.1 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 15, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()  When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB miss, without going through the software TLB store handler. The software TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED together:      ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)  Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. _PAGE_MODIFIED is left unchanged. This creates a window where a PTE has _PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED clear (software is unaware).  When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and _PAGE_DIRTY bits:      pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);  Since _PAGE_MODIFIED was never set, the dirtiness information is lost completely. Subsequently, when memory pressure triggers page reclaim, page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() returns false) and the page may be freed without writeback, causing data corruption.  Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:      if (pte_val(pte) & _PAGE_DIRTY)         pte_val(pte) |= _PAGE_MODIFIED;  The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, where pmd entries need the same treatment.  This ensures the software dirty tracking bit (checked by pte_dirty() and pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is preserved across fork COW write-protection.  The issue was found by the LTP madvise09 test case, which exercises page reclaim after "madvise(MADV_FREE), write and fork" operation sequence on private anonymous mappings.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-72043](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72043.md) | Aug 15, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.100-1 | [DEBIAN-CVE-2026-72043](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72043.md) | Aug 15, 2026 |
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-72043](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72043.md) | Aug 15, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.