CVE-2026-72175: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-jw79-wr8v-532g
Share
CVSS 7.1
Published
Advisory Summary

CVE-2026-72175 is a HIGH (CVSS 7.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72175 at a Glance

CVE Identifier CVE-2026-72175
GHSA Identifier GHSA-jw79-wr8v-532g
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-72175

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72175, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race Patch series "userfaultfd/pagemap: pre-existing fixes". These are pre-existing bug fixes that were carried at the front of the userfaultfd RWP working-set-tracking series up to v5 [1]. Per review feedback that fixes should not sit in the middle of a feature series, they are split out and sent on their own; the RWP series is reposted rebased on top of this. All six were flagged by the Sashiko AI review of the RWP series and carry independent of RWP, apply to mm-new directly, and carry Cc: stable@. 1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates when PAGEMAP_SCAN write-protects a hugetlb PTE. 2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range against HPAGE_SIZE rather than the hstate page size, so it never write-protects gigantic hugetlb pages. 3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole() calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb vma lock for read, and hugetlb_change_protection() then takes it for write. Install the marker inline instead. 4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp on a device-private PMD permission downgrade, silently losing the uffd-wp marker. 5: userfaultfd: must_wait() applies pte_write() to a locklessly read PTE without checking pte_present(), so swap/migration entries decode random offset bits and a thread can stay parked on a stale fault. 6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to mk_vma_flags() unconditionally, an out-of-bounds write into the single-word vma_flags_t on 32-bit. Build the mask from config-gated per-mode masks so an unavailable bit is never materialised. This patch (of 6): make_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by calling huge_ptep_modify_prot_commit() with a ptent snapshot that was fetched without the corresponding huge_ptep_modify_prot_start(). The start helper is what atomically clears the entry so the kernel-owned snapshot stays consistent until the commit; without it, the hardware may set Dirty or Accessed in the live PTE between the original read and the commit, and huge_ptep_modify_prot_commit() (whose generic implementation just calls set_huge_pte_at()) then writes the stale snapshot back over the live hardware bits, losing the update. The non-hugetlb sibling make_uffd_wp_pte() does this correctly via ptep_modify_prot_start() / ptep_modify_prot_commit(). Mirror that pattern for the present-PTE branch. The migration case stays as-is -- migration entries are non-present, so there's no hardware update to race against.

References

NVD — CVE-2026-72175 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72175
git.kernel.org/stable/c/04718f7c92... WEB
https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec
git.kernel.org/stable/c/50a25249a6... WEB
https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655
git.kernel.org/stable/c/6b7f774b88... WEB
https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4
git.kernel.org/stable/c/8e39ed92d7... WEB
https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab

Frequently Asked Questions

What is CVE-2026-72175?
CVE-2026-72175 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72175?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72175?
CVE-2026-72175 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-72175?
CVE-2026-72175 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72175?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jw79-wr8v-532g",
  "modified" : "2026-08-17T06:33:14Z",
  "published" : "2026-08-15T06:32:14Z",
  "aliases" : [ "CVE-2026-72175" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race\n\nPatch series \"userfaultfd/pagemap: pre-existing fixes\".\n\nThese are pre-existing bug fixes that were carried at the front of the\nuserfaultfd RWP working-set-tracking series up to v5 [1].  Per review\nfeedback that fixes should not sit in the middle of a feature series, they\nare split out and sent on their own; the RWP series is reposted rebased on\ntop of this.\n\nAll six were flagged by the Sashiko AI review of the RWP series and carry\nindependent of RWP, apply to mm-new directly, and carry Cc: stable@.\n\n  1: fs/proc/task_mmu: a missing huge_ptep_modify_prot_start() in\n     make_uffd_wp_huge_pte() can lose hardware Dirty/Accessed updates\n     when PAGEMAP_SCAN write-protects a hugetlb PTE.\n\n  2: fs/proc/task_mmu: pagemap_scan_hugetlb_entry() compares the range\n     against HPAGE_SIZE rather than the hstate page size, so it never\n     write-protects gigantic hugetlb pages.\n\n  3: fs/proc/task_mmu: PAGEMAP_SCAN with PM_SCAN_WP_MATCHING over an\n     unpopulated hugetlb range self-deadlocks -- pagemap_scan_pte_hole()\n     calls uffd_wp_range() while walk_hugetlb_range() holds the hugetlb\n     vma lock for read, and hugetlb_change_protection() then takes it\n     for write. Install the marker inline instead.\n\n  4: mm/huge_memory: change_non_present_huge_pmd() drops pmd_swp_uffd_wp\n     on a device-private PMD permission downgrade, silently losing the\n     uffd-wp marker.\n\n  5: userfaultfd: must_wait() applies pte_write() to a locklessly read\n     PTE without checking pte_present(), so swap/migration entries\n     decode random offset bits and a thread can stay parked on a stale\n     fault.\n\n  6: userfaultfd: __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT (41) to\n     mk_vma_flags() unconditionally, an out-of-bounds write into the\n     single-word vma_flags_t on 32-bit. Build the mask from config-gated\n     per-mode masks so an unavailable bit is never materialised.\n\n\nThis patch (of 6):\n\nmake_uffd_wp_huge_pte() arms the UFFD_WP bit on a present HugeTLB PTE by\ncalling huge_ptep_modify_prot_commit() with a ptent snapshot that was\nfetched without the corresponding huge_ptep_modify_prot_start().  The\nstart helper is what atomically clears the entry so the kernel-owned\nsnapshot stays consistent until the commit; without it, the hardware may\nset Dirty or Accessed in the live PTE between the original read and the\ncommit, and huge_ptep_modify_prot_commit() (whose generic implementation\njust calls set_huge_pte_at()) then writes the stale snapshot back over the\nlive hardware bits, losing the update.\n\nThe non-hugetlb sibling make_uffd_wp_pte() does this correctly via\nptep_modify_prot_start() / ptep_modify_prot_commit().  Mirror that pattern\nfor the present-PTE branch.  The migration case stays as-is -- migration\nentries are non-present, so there's no hardware update to race against.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72175"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/04718f7c9290f95385f0dd328758753dc1c36dec"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/50a25249a6355db74c2c1b6be541b4caab9f3655"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6b7f774b8882445d9174681747d37c42548686a4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8e39ed92d7c5c6bfc08dc45153916f49a4e98bab"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:35Z"
  }
}