x86 kernel bug dropped dirty bit, silently losing THP data

Linux’s x86 memory-management code could silently discard the hardware dirty bit on PMD-sized transparent huge pages, allowing rewritten data to vanish under memory pressure. Vernon Yang posted a fix after the flaw was confirmed on the kernel list.

The bug lived in pmd_modify(), which strips the dirty flag when changing page-table permissions. Companion helpers were meant to preserve dirty state as a saved-dirty bit when write-protecting a page, but with the bit already gone there was nothing left to save. The matching PTE and PUD paths kept the dirty information; only the PMD case dropped it. Any later mprotect, NUMA hinting fault, or similar operation on a writable dirty huge page therefore lost the fact that the page had been modified.

One concrete failure mode involves MADV_FREE on anonymous THP. After an application marks a range freeable, rewrites it, then changes protections, reclaim can treat the folio as clean and discard it. Subsequent reads see freshly zeroed pages. The same path affects PMD-mapped file THPs: dirty data is never written back. NUMA balancing alone is enough to trigger the loss because it restores the PMD through the same modify path.

Orson Peters reported that the issue is not theoretical. Users of the Polars data-analytics library observed live data changing silently in production on multi-NUMA machines running default Ubuntu settings once cgroup memory limits were present. The combination of transparent huge pages, MADV_FREE, NUMA hinting and memory pressure is uncommon on desktops but ordinary in high-performance analytics workloads.

Yang’s change keeps the dirty bit in the preserved mask so the existing saved-dirty transition logic can run correctly, including shadow-stack encoding rules. The regression was introduced when saved-dirty tracking was first enabled and shipped in Linux 6.6; stable backports are expected given the severity of silent corruption.